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SNIFFER NETWORK ANALYZER” 


Network 
General 


Preface 


About This Manual 


This manual describes the functions and operations of the Token-Ring Monitor, 
a software component of the Sniffer™ Network Analyzer. It also gives 

recommendations on how to use the monitor effectively to detect network 
problems. 


The Sniffer Network Analyzer observes the local or wide-area network to which 
it is attached, and displays the monitored activity. 


Organization of This Manual 


Figure i describes the organization of this manual. 


Chapter/Appendix 


Chapter 1, “Product 
Overview” 


Chapter 2, “Getting 
Started” 


Chapter 3, “Displaying 
Statistics” 


Chapter 4, “Managing the 
Station Data Files” 


Chapter 5, “Working with 
Alarms” 


Chapter 6, “Creating 
Reports” 


Chapter 7, “Establishing a 
Baseline for Your 
Network” 


Chapter 8, “The Monitor 
Data Files” 


Chapter 9, “The Monitor 
Menu Items” 


Contents 


Provides an overview of the monitor and 
describes its capabilities. 


Describes the preparation required before you 
start a monitoring session. It also discusses the 
menu structure. 


Describes how to display various types of 
statistics gathered in the current monitoring 
session. 


Describes how to specify information about 
stations on the network, which affects the way 
the monitor observes the network and 
generates alarms. 


Describes different types of alarms. 


Describes the report scripts and gives 
procedures for generating, printing, and 
saving reports. 


Provides recommendations on how to use the 
monitor features to become familiar with 
normal network traffic patterns. 


Describes the files that you might need to 
modify or view when using the monitor. 


Explains in detail all the menu items and the 
terms used in the monitor's screen displays. 


Figure 1. Scope of each chapter or appendix in this manual. 
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Chapter/Appendix Contents 
Appendix A, “Error and Lists all warning and error messages and 
Warning Messages” describes recommended actions. 
Appendix B, “Report Lists and describes the report fields that you 
Fields” can insert in a report script. 


Appendix C, “Ethertype Lists the hexidecimal values of various 
Values in SNAP SAPs” Ethertypes.s 


Figure 1. Scope of each chapter or appendix in this manual. 


Audience of This Manual 


The Token-Ring Monitor Operations manual has been prepared with the 
following assumptions: 


* You are a Token-Ring network manager or troubleshooter who 
understands how a Token-Ring network operates. 


¢ You are familiar with DOS. 


* You have properly started the Sniffer Network Analyzer. 


Navigational Aids Used in This Manual 


Xvi 


To help you find procedures easily, there is a separate list of procedures in this 
manual in addition to the Table of Contents and List of Figures. Also, there are 
“Recommendation” entries in the Index to point you to suggestions for getting 
the most from your Token-Ring Monitor. On several occasions, this manual 
refers to publications from other vendors; the List of References provides the 
titles of these publications. 


This manual uses icons in the margin to help you locate information as 
explained below: 


IMPORTANT INFORMATION. Next to this icon is information that is 
especially important; you should be certain to read it carefully before you 
proceed. This icon also indicates useful and valuable ways of using the product. 


CAUTION. Next to this icon is information that you must know to avoid 
damage to data files, program files, or hardware devices. This icon also 
indicates information that you must know to avoid possible injury to yourself 
or others. 


PROCEDURE. Next to this icon is a series of steps for accomplishing a particular 
task. 


Conventions Used in This Manual 


Conventions Used in This Manual 


Special Notations 


Terminology 


Screen Displays 


The following describes the conventions used in this manual: 


Bold Menu options and menu names are in bold type. For 
example: 


Move to Display and press Enter. 
Move to the Report\Print menu. 


UPPERCASE The filenames and command names you type at a DOS 
prompt are in uppercase. For example: 


Modify the AUTOEXEC.BAT file if necessary. To 
duplicate the file, use the COPY command. 


Bold italics Variables, for which you insert values, are in bold italics. 
For example: 


Type the number of minutes and seconds in the mmiss 
format. 


Screen font Screen messages are printed in monospaced font. For 
example: 


If a monitoring session is in progress, the following 
message appears: 


You must stop monitoring before you can use this feature. 


Hexadecimal numbers mentioned in the manual are followed by “(hex)”; 
numbers without any notations are decimal. For example, “The maximum 
number of stations is 75. The default memory address is D8000 (hex).” 


The term “application” refers to a software component (that is, the monitoring 
or analysis program) running on the Sniffer Network Analyzer. 


This manual sometimes uses abbreviated names for the various components of 
the Sniffer Network Analyzer. The term “monitor” stands for the Token-Ring 
monitoring application, and the term “analyzer” stands for the Token-Ring 
analysis application. 


The screen displays in this manual may not exactly match what you see on your 
screen. There may be certain minor differences that do not affect the functions 
of the displays. 
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Other Sources of Information 


On-Line Help 


‘Tutorial 


Technical Support 


Training 


Xviil 


Network General Corporation (NGC) provides other sources of information 
that can help you get familiar with the Sniffer Network Analyzer. 


After highlighting an item in the analyzer or monitor menu, a phrase or 
sentence in a panel near the bottom of the screen explains the meaning of the 
highlighted item. 


If you want to obtain general information on a particular feature of the Sniffer 
Network Analyzer, press F1 at any time. A window containing a list of topics 
opens. If you are displaying a monitor statistics screen, pressing F1 gives you 
information on the current screen. | 


NGC distributes a booklet with accompanying diskette entitled Real Networks. 
Real Problems. It presents case studies based on data captured with a Sniffer 
Network Analyzer from four different networks. The case studies allow you to 
see how investigation of a network problem proceeds. 


You can obtain the tutorial free of charge from any of the company’s sales 
representatives or directly from NGC. 


If you have problems with the Sniffer Network Analyzer, refer to the 
Troubleshooting section of the Sniffer Network Analyzer: Analyzer Operations 
Manual for the procedure to contact NGC’s technical support. 


NGC offers a comprehensive set of training courses focused on hands-on 
network analysis and troubleshooting using the Sniffer Network Analyzer. For 
more information contact your sales representative. 


Manuals for the Sniffer Network Analyzer 


Manuals for the Sniffer Network Analyzer 


Figure ii lists the manuals that accompany the Sniffer Network Analyzer. These 
manuals describe normal operation. The actual manuals in your shipment 


depend on the system configuration. 


If the product shipment includes release notes or README files on disks, the 
information in the notes or files supersedes the information in this manual. 


For Information On... 


Installing and configuring the Sniffer 
Network Analyzer. 


Operating the analysis functions on an 
Ethernet or Token-Ring network. 


Operating the monitor functions on an 
Ethernet network. 


Using the monitor features effectively to 
detect network abnormalities. 


Operating the monitor functions on a 
Token-Ring network. 


Using the monitor features effectively to 
detect network abnormalities. 


Various network and protocol types. 


Operating the Sniffer Network Analyzer 
from a remote PC via modem. 


Read... 


Sniffer Network Analyzer: 
Installation Guide. 


Sniffer Network Analyzer: 
Analyzer Operations. 


Sniffer Network Analyzer: 
Ethernet Monitor Operations. 


Sniffer Network Analyzer: 
Token-Ring Monitor 
Operations (this manual). 


Sniffer Network Analyzer: 
Network and Protocol 
Reference. 


Sniffer Network Analyzer: 
TeleSniffer Installation and 
Operations. 


Figure tt. Manuals for the Sniffer Network Analyzer. 
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CHAPTER ONE: PRODUCT OVERVIEW 1 


Network 


Product Overview 


Overview 


The Token-Ring Monitor is a network monitoring program. ‘This chapter 
describes the monitor’s features, typical application, and requirements. 


What the Monitor Can Do 


The monitor provides an accurate picture of network activity at any moment or 
a historical record of network activity over a period of time. This information 
helps you find traffic overloads, plan for network expansion, detect intruders, 
establish performance baselines, and distribute traffic more efficiently among 
servers and subnets. 


The monitor’s report capabilities let you communicate this information to 
others, complete with graphs and tables. The alarm capabilities alert you to 
problems with the network or with individual stations before users call you to 
complain. 

The following list summarizes the capabilities of the monitor: 


¢ Monitors up to 1,024 network stations at data rates of up to 2500 frames 
per second 


* Generates visible and audible alarms for the entire network or for 
individual stations 


* Compiles a historical alarm log | 


¢ Provides real-time traffic and historical information for individual 
stations as well as for the entire network 


¢ Sorts statistics to show only those items that interest you 
¢ Creates customized management reports 


¢ Automatically prints selected information at set time intervals 


The monitor loses frames from the Token-Ring network when the traffic 
exceeds approximately 2500 frames per second. However, the monitor does not 
inform you that it is losing frames. 


The Token-Ring Monitor can monitor a network continuously for up to 49 days. 
After 49 days, the monitor automatically resets. 


The monitor rounds up small percentages to 0.01%. Keep this in mind when you 
interpret percentages in statistical views or reports. 
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Typical Application 


This section describes how the monitor is typically used to gather statistics on 
the network. 


The monitor only monitors frames on the Token-Ring network to which the 
network interface card is attached. Figure 1-1 shows how the monitor is 
typically used on a Token-Ring network. 


Network Stations 


ss. =5 


We 
OW The Token-Ring Monitor in this 


Sniffer Network Analyzer 


Sniffer Network Analyzer 
monitors the traffic on NetworkA. 
It also provides statistics related 
to traffic routed by the Token- 
Ring bridge. 


Figure 1-1. A Sniffer Network Analyzer running the Token-Ring Monitor 


System Requirements 


- 


The monitor can be used only on an IEEE 802.5-compatible network that 
operates at 4 Mb/s or 16 Mb/s. 


If you are running the IBM® LAN Network Manager on the network, it must be 
configured so that the Token-Ring Monitor can monitor the network. If the LAN 
Network Manager is not configured properly, it will remove the monitor from 
the network. For further information on configuration, refer to IBM's 
documentation on the LAN Network Manager. (The LAN Network Manager 
described here is a program from IBM that manages a local area network; it is 
not the LAN Manager developed by Microsoft®, which is a network operating 
system.) 
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Network 


Getting Started 


Overview 


You can modify the option settings presented in the monitor’s Main Menu to 
specify how the monitor operates. For example, you can determine: 


¢ How the monitor monitors the network 
¢ How the monitor collects statistics 


¢ How the monitor presents statistics 


The monitor is shipped with default option settings that you can use to start a 
monitoring session. However, it may become necessary to customize these 
settings to suit the needs of your network. Familiarize yourself with these 
options so that you can interpret and use the statistics efficiently. 


This chapter describes the following: 
* Starting the monitor. 


¢ Configuring the monitor. (More information on how to further 
customize the monitor is given in subsequent chapters.) 


* Interacting with the monitor. 


* Running the monitor in the background. 


Outline of the Getting-Started Procedure 


The following list outlines the steps for getting started with the monitor: 
1. Start the Sniffer Network Analyzer. 
2. Select Token-Ring Monitor from the Main Selection Menu. 


3. Configure the Token-Ring Monitor. (This step can be skipped since the 
default configuration can be used unchanged.) 


4, Start the Token-Ring Monitor. 


Specify whether the monitor gathers information from all stations or a 
particular station. 


Specify the types of frames to be monitored. 
7. Specify the station for which history statistics are to be collected. 


otart a monitoring session. 


The following sections describe these tasks in detail. 
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Starting the Sniffer Network Analyzer 


There are two different methods of starting the Sniffer Network Analyzer. The 


Sniffer Network Analyzer starts: 
¢ Automatically when the PC is booted up 
¢ When you type MENU at a DOS prompt 


Figure 2-1 shows the Main Selection Menu which is displayed on the screen 
once the Sniffer Network Analyzer is started. From this menu, you can start the 
monitor or analyzer, return to the operating system, or perform other tasks. 


tm 
The Sniffer Network Analyzer 


(C) Copyright 1986-1992, Network General Corporation 


ain selection menu 


Token-Ring-16/4 Analyzer § External color monitor 
Token-Ring-16/4 Analyzer §_ External LCD projector 


Token-Ring Monitor | Return to DOS 
eleSniffer System shutdown 


Configuration Utility 


Go to Token-Ring Monitor selection menu. 


se arrow keys to select, then press Enter. —====—=== 


Figure 2-1. Main Selection Menu 


Select the Token-Ring Monitor 


When you select Token-Ring Monitor from the Sniffer Network Analyzer Main 
Selection Menu, Figure 2-2 is displayed on the screen. From this menu you can 
start, configure, or run a demo of the Token-Ring Monitor. You can also return 


to the Sniffer Network Analyzer Main Selection Menu. 


om 


Starting the Sniffer Network Analyzer 


Token-Ring Monitor Selection menu 


onfigure Token-RKing Monitor 
Demo Token-Ring Monitor 
Return to main menu 


Run the Token-Ring Monitor. 


se arrow keys to select, then press Enter. 


Figure 2-2. Token-Ring Monitor Selection Menu 


Configuring the Token-Ring Monitor 


The configuration settings for the Token-Ring Monitor include the network card 
settings and the monitor settings. Since the default settings will work for most 
systems, you can skip to the next section unless you want to change the default 
settings. 


The network card settings used by the network interface card must be unique; 
that is, no other cards in your system, or devices attached to your system, can 
use the same settings. If you purchase a complete system, the software and 
network interface card are properly configured at the factory. If you buy a 
module and the software, or receive an update, these settings are automatically 
configured to work with the network interface card as originally configured at 
the factory. You do not have to change them unless they conflict with other 
devices. 


The monitor settings determine the maximum number of stations to be 
monitored and the number of history intervals to be recorded. Keep in mind 
that changing the number of stations on the network or the number of intervals 
stored affects the amount of RAM used. For example, if you monitor 1024 
stations for 1750 15-minute intervals (the default), the TRMONDRV program 
requires about 138K of RAM. If you decrease the number of stations monitored 
to 75, only about 85K of RAM is required. 


You can easily make configuration changes later as your needs change. 
However, the statistics from the most recent monitoring session are erased. 


es 


Sniffer Network Analyzer: Token-Ring Monitor Operations 


2-6 


KI 
OY 


= 


To configure the Token-Ring Monitor: 


1. 


From the Token-Ring Monitor Selection Menu, move to Configure 
Token-Ring Monitor and press Enter. The Configuration Options menu 
appears (see Figure 2-3). 


The Configure Token-Ring Monitor option appears in the selection 
menu only when the monitoring program is not loaded; you cannot 
change the configuration while the Token-Ring Monitor is running. You 
must first select Exit from the Token-Ring Main Menu and then select 
Terminate Token-Ring Monitor from the Token-Ring Monitor Selection 
Menu. 


CONFIGURATION OPTIONS Vj 


Network General Copyright 1988 - 1992 


Network Card Settings Monitor Settings 


Card Position = Primary <# | Maximum Stations = 1024 d 


Memory Address = D8Q00 [By History Length = 1758 4 


Specify the network card's base memory address. 


=Use the arrow keys to move, or ENTER to change this value 


9 Undofild 
Cielinecs Mens 


Figure 2-3. Configuration Options Menu 


2. 


Use the Arrow keys to move to the setting you want to change. Press 
Enter to display a list of options or a dialog box that lets you enter a 
value. 


Move to the correct value or type a value and press Enter. Press Esc to 
abort without changing the value. 


Repeat these steps for any other settings you want to change. 


Press F2 to run the card test. If the network interface card can operate 
with the new settings, a message appears indicating that the card passed 
all tests. 


If there is a problem, a dialog box identifies the problem so that you can 
correct it. (If necessary, refer to Appendix A, “Error and Warning 
Messages,” for information on the displayed message.) Depending on 
the problem, it may be necessary to change the value of a setting or the 
configuration of the card. Once you have corrected the problem, repeat 
the card test. 


Starting the Sniffer Network Analyzer 


6. Press F10 to exit the configuration menu and return to the Token-Ring 
Monitor Selection Menu. The Token-Ring Monitor automatically saves 
the settings you defined to the file C: \TRSNIFF\TRMON.CFG. 


Network Card Settings 


The following list describes the network card settings in the Configuration 


Options view. 


Card Position 


Memory Address 


Monitor Settings 


Specifies whether the Token-Ring network card is 
the primary or alternate network card. The setting 
must match the hardware configuration on the card. 


The possible values are Primary and Alternate. The 
default is Primary. 


Specifies the starting address of the shared RAM 
that resides on the network interface card, which is 
used to send data between the network and the PC. 


The possible memory base address ranges from 
80000 to F3000 (hex). The default is D8000. The value 
you enter must be a multiple of 1000 (hex). 


Be sure that the memory address does not overlap 
the ROM address, which is determined by the 
switch settings on the network interface card. 


The following list describes the monitor settings: 


Maximum Stations 


History Length 


Determines the maximum number of stations that 
can be monitored. The possible value ranges from 1 
to 1024. The default is 1024. 


Determines the number of history intervals for 
which the Token-Ring Monitor stores history 
statistics. For example, if you specify that each 
history interval is 15 minutes (“Specifying History 
Interval” in Chapter 3 describes how to set this 
value), and that History Length is 20, the Token- 
Ring Monitor stores statistics for the last 20 time 
periods, each of which is 15 minutes. The possible 
value ranges from 5 to 1750. The default is 1750. 


The following is a list of guidelines for changing the monitor settings: 


¢ Initially, set Maximum Stations to a value that is 10% to 20% higher 
than the number of current stations, to allow for growth and for the 
needs of the Token-Ring Monitor software. (If you will not be running 
other DOS applications while the monitor is in the background, you can 
leave this setting at 1024.) A Token-Ring network segment supports up 
to approximately 250 stations. 
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Each group address is regarded as a station. When setting Maximum 
Stations for the first time, you should assume that there are about 10 to 
20 group addresses on the network. After monitoring the network for 
several days, you will know the actual number of group addresses, and 
you can adjust the maximum number of stations accordingly. 


Remember to count remote stations when setting Maximum Stations. 


Increasing the number of stations to be monitored or collecting more 
intervals increases the amount of RAM used by the TRMONDRV 
program. This reduces the amount of RAM available for other 
foreground programs. (TRMONDRYV allocates about 60 bytes to each 
station and about 40 bytes to each history interval.) 


When you start the monitor, the following occur: 


The monitor driver is loaded into memory. The driver is a memory- 
resident program used to monitor the network, and can run in the 
background to continue monitoring while you are running another 
DOS application. 


The monitor application program is loaded into memory, which 
displays the Main Menu (Figure 2-5). From this menu, you can start a 
monitoring session, configure option settings, and use other features of 
the monitor. 


To start the Token-Ring Monitor: 


I. 


From the Token-Ring Monitor Selection Menu, move to Run Token- 
Ring Monitor and press Enter. The Initialization prompt appears (Figure 
2-4). 


Press any key. The Token-Ring Monitor Main Menu appears 
(Figure 2-5). 


Starting the Monitor 


tm 
The Sniffer Network Monitor 


for Token-Ring 


Version 1.48 


Network Address @@2GA6EZQ2B9 


Network General Corporation 
(C) Copyright 1988-1992 


4 Press any key > 


Figure 2-4. Initialization Prompt. 


ENUS= SRT EEN ee SaS RCM eT ae 
Global statistics ¢ 


Single station 4 

Network Transmit timer All stations SE 
General 1 Station test Frame sizes < 
Monitor filters Routing info pi 

< 

< 

d 


History Protocols 

Token-Ring Sniffer Alarm log 
Network Monitor arn Global history 
Report Station history 


Version 1.49 Manage stations 
Options Class 
(C) Copyright Exit 
1988 - 1991 Network usage 


Display traffic statistics. 


======<Jsg the arrow keys to move, or ENTER to do this function 


i 1g New 
Help monitor 


Figure 2-5. Token-Ring Monitor Main Menu. 
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Interacting with the Monitor 


This section describes the notations used in the monitor menus, and how you 
select options and values. For specific tasks (for example, displaying statistics 
for a particular station), refer to the chapters that follow. 


The Menu Structure 


All functions of the monitor, except configuration, are accessible through the 
Main Menu, which is the center panel in Figure 2-5. When the Main Menu first 
appears, the Display option is highlighted. Options associated with the Display 
option are listed in the panel to its right. This organization is consistent 
throughout the monitor’s menu structure; options associated with any 
highlighted option in the center panel always appear to its right. Some options, 
however, may not be visible until you move into the panel and scroll. 


In this manual, a list of options displayed in a panel is called a menu; the name 
of the menu is the highlighted option in the center panel. For example, in Figure 
2-5, the highlighted option is Display, and the right panel is the Display menu. 


A back slash is used in this manual to specify the location of an option if more 
than one level of menu is involved. For example, to refer to the Numeric option 
associated with the Global statistics option in the Display menu, the manual 

uses this notation: the Numeric option in the Display \ Global statistics menu. 


Moving Through the Menus 


You can move through the menu structure both vertically and horizontally. A 
highlight shows your current location. Move through the menus by: 


¢ Pressing the cursor keys: 


For example, when Display is highlighted, pressing Cursor Up 
deselects Display and highlights History. 


* Pressing the Page Up, Page Down, Home, and End keys: 


For example, if your current selection is Display, pressing Page Up or 
Home selects the first command, Transmit timer. Pressing Page Down 
or End selects the last option in the list, Exit. 


¢ Typing the first letter of the command's name: 


If two or more options start with the same letter, the monitor selects the 
first one that follows the current command. For example, if the 
command currently highlighted is Display, pressing M selects Manage 
stations; but if Station test is the current selection, pressing M selects 
Monitor filters. 


Options in the Main Menu 


In the Main Menu, a carriage return symbol (€) appears to the right of Transmit 
Timer, Display, and Exit. The symbol indicates that you can press Enter to 
trigger an action when the option is selected. That is, if Display is highlighted, 
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pressing Enter displays one type of statistic; if Exit is highlighted, pressing Enter 
leaves the Main Menu and returns to the Main Selection Menu. 


When the carriage return symbol appears next to a menu item that is a settable 
parameter, the symbol indicates that you can edit the parameter by pressing 
Enter. 


Other items in the center panel are not followed by carriage return symbols. 
They are names of submenus that display options and specify values. For 
example, when History is highlighted, pressing Enter does not trigger any 
action. Highlighting History displays the History menu, which shows the 
current settings that determine how the monitor accumulates history statistics. 
If necessary, use the cursor keys to move to the next submenu and/or desired 
parameter. 


Choosing Menu Options and Defining Values 


After selecting an option that triggers an action, you can press Enter to execute 
it. If you select a menu item that does not generate an action, move to one of its 
options. 


Regardless of the type of option selected, if you highlight an option followed by 
a carriage return symbol and press Enter, one of the following happens: 


¢ An action is triggered. For example, if you move to Clear in the Report 
menu, the monitor removes the report script from memory. 


¢ A list of values or a dialog box appears. The value you specify in the list 
or dialog box affects how a future action works. For example, if you 
move to Stn in the History menu, a list of station addresses appears for 
you to select the desired station for which history statistics are to be 
gathered. Refer to the section, “Choosing Among Values,” for further 
information on how to assign a value to an option. 


The monitor “remembers” the values you assign even after you exit the 
program or turn off the Sniffer Network Analyzer. The next time you start the 
monitor, the same settings appear on the menu. However, if the Sniffer 
Network Analyzer is powered off or rebooted while the monitor is running, it 
loses the new values that you assigned during the session. 


Choosing Among Menu Options 


A list containing mutually exclusive options is identified by a vertical bar to its 
left. To select an item, move to it and press the Spacebar or Enter key. If an item 
is selected, an arrowhead is moved next to it. For example, if Alarm log is 
selected, the symbol “|>” appears to its left, as shown in Figure 2-6. 


Not all options are included in a list. For example, the Class option in the 
Display menu appears by itself, since it logically modifies other options. 
Selecting Class displays another menu, which lists mutually exclusive values 
(To, From, and Both) that determine the type of traffic to be displayed. To select 
the desired value, move to the value and press the Spacebar or Enter key. 
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If you select an option with the Enter key, and the option is associated with an 
action in the menu panel to its left, the action is performed automatically. 


Global statistics 
Single station 

Transmit timer All stations 

Station test Frame sizes 

Monitor filters Routing info 

History 

Display 

Alarm obal history 

Report Station history 

Manage stations 


Options Class 
Exit 


Network usage 
Display, acknowledge, and clear alarns. 


Press space to select this pti === 


10 New 
monitor 


Figure 2-6. Alarm log option in the Display menu. 


Choosing Among Values 


For some options you can assign values, and the assigned value is displayed 
after an equal sign. For example, one of the options in the Alarm menu is 
displayed as Auto clear = 01:00. It means that the value 1 hour has been 
assigned to the Auto clear option. 


To assign a value, move to the option and press Enter. Then one of the following 
happens: 


¢ A dialog box appears, prompting you to type a value. 
Type a value within the permissible range and press Enter. 


¢ A list of values appears. Move to the desired value and press Enter. 


If you do not want to enter or select a value after the dialog box is opened, press 
Esc to close the box and return to the menu. 


Figure 2—7 is an example showing a station list from which you choose a station. 


a 


Toggling Values 
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STATION LIST 
=| Alex Zwick 
Anthony Serrao 
Barbara Lemmon 
Barney Ingram 
Bill Goodman 
David Brooks 
Denise Martin 
Stn = File Server ¢ Ed Hicks 
Numeric red Biddle 
Graphic George Stanley 
Helene Milici 
Alarm log Jack Clayton 
Global history James Wylie 
orel Jill Franz 
Select a station for display. Ken Quinn 
Linus Stanwick 
=====(Jse the arrow keys to move, or ENTER to do this f| Mark Ellison 
Michael Harley 
Miles Russell 
Press ESC to exit 


Global statistics 
single station 

All stations 
Frame sizes 
Routing info 


Protocols 


RABRAAAAA 


Figure 2-7. Station list. 


Some options can be toggled; that is, you can either select or deselect them. For 
example, if you select the All stations option in the Display menu, the option 
Active stns only, preceded by a V mark, appears in the right panel. This option 
determines the type of station to be included in the display, and the V mark 
indicates that it has been selected. 


To select an option, move to highlight it and then press the Spacebar. A V mark 
precedes a selected option. Pressing the Spacebar again deselects an item, 
displaying an x mark next to it. (The Enter key has no effect here.) 


If you press Alt and the Spacebar simultaneously, the V and x marks are 
reversed for all items in the same menu. This is very useful when selecting many 
items in long menus. 


Figure 2-8 shows the configuration of the All stations option in the Display 
menu. 
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x Partner's name 
Global statistics x Ring state 
Single station / Frames 
All stations / Errors 
Frame sizes / Bytes 
Routing info / Average size 
Protocols / Network usage 


Alarm log x First activity 
Global history x Last activity 
x Elapsed activity 
orel 
Display station activity in a tabular format. 


Press space to select this option= 


18 New 
monitor 


Figure 2-8. Configuration of the All stations option. 


Using the Function Keys 


When the monitor displays a menu or statistical display, you can use the 
function keys to manipulate the display or perform various monitor functions. 


From menus, you can use the following function keys: 


¢ F1 (Help) displays the main Help menu. For further information on the 
Help menu, refer to the section, “Using On-Line Help” on page 2-15. 


¢ F3 (Display) displays the statistics according to the options associated 
with Display. This key is applicable only after you start a monitoring 
session. 


¢ F10 (New monitor/Stop monitor) starts or stops a monitoring session. 
This key toggles between the two functions. 


From views, you can use the following function keys to navigate between 
menus and options. Other function keys may be available, depending on the 
view being displayed. Those keys are described in the chapters corresponding 
to the views. 


¢ F5 (Menus) returns you to the Main Menu. 


¢ F6 (Display options/ Return) lets you display and edit options without 
returning to the Main Menu. This key toggles with “Return,” which 
returns you to the view. 


In addition to using the function keys, you can press Esc to go back to the 
previous screen. 
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Using On-Line Help 


The monitor provides an on-line help facility that displays information about 
the following topics: 


* Moving around the menu tree 
¢ Selecting menu options 

¢ Using the function keys 

¢ Testing the transmit wait time 
¢ Running protocol-specific station tests 
¢ Monitoring network traffic 

¢ Setting monitor filters 

¢ Specifying history information 
¢ Displaying statistics 

¢ Working with alarms 

¢ Using the report writer 

¢ Managing station information 


wre To use on-line help: 


LOZ 1. Press F1 (Help) to display the Help menu or relevant submenu. If you 


press F1 when one of the monitor views is displayed, a description of that 
view appears. 


2. InaHelp menu, move to the topic for which you want additional 
information and press Enter. 


To scroll through help text, press Cursor Up, Cursor Down, Page Up, or 
Page Down. 


3. Press Esc to return to the Help menu. Press Esc again to return to the 
screen display before you used on-line help. 


Preparing for a Monitoring Session 


Before starting a monitoring session from the Main Menu, you should: 
¢ Verify the network speed. 


¢ Specify the type of frames to be monitored (Logical Link Control 
frames, Medium Access Control frames, or both). 


¢ Specify the station for which you wish to collect history statistics. 


¢ Specify the stations you wish to monitor (all stations or a single 
address). 


Monitoring only one station means that you restrict monitoring to the frames 
from or to a particular station. Remember that the statistics the monitor 
compiles are based on these frames only. For example, if you choose to monitor 
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Station A and it has not been sending or receiving frames, the monitor shows no 
global statistics even though other stations are active during this monitoring 
session. The monitor filters out traffic from, or to, other stations. 


If you restrict monitoring to a single station, familiarize yourself with how the 
monitor generates alarms by reading the section “Interpreting Alarms When 
Using Monitor Filters” on page 5-7. 


Verifying the Network Speed 


The Token-Ring network interface card can transmit and capture data at either 
4Mbps or 16Mbps. The Token-Ring network interface card must be set to the 
same speed as the network that it monitors. A network interface card entering 
the network at the wrong speed will bring down the network. 


You can modify the network interface card’s monitoring speed through the 
Options menu. To change the transmit speed, you must change the setting on 
the network interface card. For further information on setting the transmit 
speed, refer to the Sniffer Network Analyzer: Installation Guide. 


To modify the monitoring speed: 
1. Move to Options in the Main Menu. 


2. Move to the appropriate speed and press the space bar to select the 
speed. 


Specifying Which Stations to Monitor 
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Monitoring all stations gives you the option of displaying statistics for any or all 
stations. If you have not started a monitoring session before, it is recommended 
that you monitor all stations. The maximum number of stations is set in the 
Configuration Menu. 


To specify which stations to monitor: 


1. You can specify the stations only when the monitor is not monitoring. 
Make sure that the key label for F10 is “New monitor.” The key label 
“Stop monitor” indicates that a monitoring session is in progress. To stop 
a session, press F10. 


Move to Monitor filters in the Main Menu. 


2. To monitor all stations, move to the All stations option and press the 
Spacebar. 


To monitor a particular station, move to the Stn option and press Enter 
to display the station list. Move to the station to be monitored, and press 
Enter. The monitor observes only the frames to or from the specified 
station. 


The station list contains the same station names that are in the 
STARTUP.TRD file in the TRSNIFF directory, which is also used by the 
analyzer. Refer to “The Station List” on page 2-18 for further information 


Using the Monitor with the IBM LAN Manager 
on how the monitor adds station addresses to the list as it monitors the 
network. 


The new setting takes effect in the next monitoring session. 


Specifying the Types of Frames to Be Monitored 


You can configure the monitor to monitor only the MAC frames, the LLC 
frames, or both. The MAC frames contain information on the network status, 
and are generated automatically by network interface cards on the Token-Ring 
network. The LLC frames are data frames sent by the host computers on the 


network. 
SAS To specify the types of frames to be monitored: 
PY 1. Stop the monitor if a monitoring session is in progress. Move to Monitor 


filters in the Main Menu. 


2. Tomonitor both MAC and LLC frames, move to All frames. To monitor 
either type of frame, move to LLC frames or MAC frames. Press the 
Spacebar to choose the option. 


The new setting takes effect in the next monitoring session. 


Specifying History Options 


History statistics provide an overview of when the network was busy, at what 
time of the day stations generated errors, and so on. You can configure the 
monitor to collect history statistics for a specified address. This is different from 
global history which is the overall network traffic history. 


Be sure that the station for which the statistics are collected is also a station that 
the monitor monitors. Suppose it monitors the traffic to and from ServerA only 
and you specify that history statistics be collected for ServerB. Unless the 
servers communicate with each other, the monitor displays no station history 
statistics for ServerB. However, if ServerB communicates with ServerA, that 
activity is recorded under ServerA traffic. 


KA To select the station for which the monitor will collect history statistics: 
QY 1. Move to the Stn option in the History menu. 


2. Press Enter to display the station list. 


3. Move tothe station that you want to collect history statistics for and press 
Enter. 


Using the Monitor with the IBM LAN Manager 


If you are running the IBM® LAN Network Manager on the network, it must be 
configured so that the Token-Ring Monitor can monitor the network. If the LAN 
Network Manager is not configured properly, it will remove the monitor from 
the network. For further information on configuration, refer to IBM’s 
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documentation on the LAN Network Manager. (The LAN Network Manager 
described here is a program from IBM that manages a local area network, it is 
not the LAN Manager developed by Microsoft®, which is a network operating 
system.) 


Starting a Monitoring Session 


The Station List 
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The monitor is ready to monitor the network after you configured it according 
to the instructions in the previous sections. 


To start a monitoring session: 


Press F10 (New monitor). The monitor displays these messages, one after the 
other: 


Resetting the network card. 
Entering the ring. 


After a monitoring session starts, the key label on the screen for F10 changes to 
“Stop monitor.” 


You can examine the statistics gathered in a monitoring session in various ways. 
For example, you can display statistics, generate statistical reports, view the 
alarm log, and so on. You can do this while the monitor is running or after you 
have stopped it. The chapters that follow describe these tasks in detail. 


The monitor can automatically start a monitoring session every time it prints a 
report. This is controlled by the Restart monitor option in the Report \ Auto 
print menu. Refer to “Printing a Report Automatically” on page 6-18 for more 
information on restarting a monitoring session. 


When you first run the monitor, the station list contains the station names in 
STARTUP.TRD, a station data file that is also used by the analyzer. The station 
list remains in memory until you terminate the monitor. If you want to monitor 
or collect statistics for a particular station, choose the station from this station 
list. 


Once the monitor starts a monitoring session, it can detect unnamed stations on 
the network. If you set Monitor filters to All stations, it detects any station that 
transmits frames on the network during the monitoring session. If the Stn 
option is selected instead of All stations, and Stn is set to an address, the 
monitor detects those stations that have sent frames to, or received frames from, 
the specified address. In either case, the monitor adds the detected station to the 
station list until the list is full. When the list is full, the monitor adds stations 
based on priority. Local stations have priority over remote, unnamed stations in 
the station list. That is, if a local station is to be added to a full station list, a 
remote, unnamed station is removed from the list. 


If a station you want to collect statistics for does not appear on the list after 
monitoring the network for a while, check to make sure that the station is 


Naming Stations 


=> 


Starting a Monitoring Session 


powered on and sending frames. If the station’s address still does not appear in 
the station list, this may indicate a connectivity problem between the station and 
the network. 


Figure 2-9 illustrates how the monitor uses the station list. 


Adding unnamed addresses 
detected on the network 
during a monitoring session. 
Unnamed addresses remain 
in memory until the driver is 
terminated. 


= 
@ 
= 
.e) 
=y 
~~ 


STARTUP.TRD 


Sniffer Network Analyzer 


Figure 2-9. The monitor loads and modifies the station list. 


For further information on naming stations and STARTUP.TRD, refer to 
Chapter 4, “Managing the Station Data Files.” The Sniffer Network Analyzer: 
Analyzer Operations manual also describes the station data file. 


You are not required to name all stations on the network before starting a 
monitoring session. However, it is recommended that you name the stations for 
these reasons: 


¢ When the monitor detects a station on the network that has not been 
assigned a name, the monitor may generate an unknown station alarm. 
(The unknown station alarm is disabled by default; so this happens 
only if you have enabled it. For more information on controlling alarms, 
refer to Chapter 5, “Working with Alarms.” ) This alarm alerts you to 
intruders or to possible problems with network bridges or 
malfunctioning network interface cards. It is useful only if all the 
legitimate stations have been named. 
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¢ The unnamed station addresses are lost when you remove the monitor 
driver from memory or start a new monitoring session. 


¢ The monitor loads the station names into the station list in memory 
when you start the monitoring application and adds unnamed stations 
to the list once it starts monitoring. But if more than 1,024 stations exist 
on the network, the monitor stops adding unnamed stations to the list. 
Any station not in the station list cannot be monitored. 


For further information on naming stations, refer to Chapter 4, “Managing the 
Station Data Files.” 


Stopping a Monitoring Session 


When you stop a monitoring session, the driver stops monitoring, but remains 


in RAM. 
KZ To stop a monitoring session: 
wy 
1. Press F10 (Stop monitor). The following message appears: 


The Sniffer Network Monitor will stop monitoring if you proceed. Press ENTER 
to proceed. Press ESC to cancel. 


2. Press Enter. The following happen: 
¢ The label of F10 on the screen changes to “New monitor.” 


¢ If you display a statistics view, the clock in the upper right corner 
shows “ENDED,” followed by the time at which you pressed F10. 


¢ The statistics gathered during the monitoring session that you just 
terminated are still available for display. They are lost, however, 
once you start another monitoring session, remove the monitor 
driver from memory, or reboot the computer. To save the statistics, 
generate reports according to the instructions in Chapter 6, 
“Creating Reports.” 


Monitoring in the Background 


You can run the monitor in the background, without displaying the Main Menu 
or any statistical view. 


However, monitoring in the background has these limitations: 
¢ You cannot display statistics. 


* When you stop the monitoring session, the monitor loses the statistics 
collected (unless you bring it first to the foreground). 


¢ You cannot save history statistics and reports to the disk. 


¢ When the monitor generates an alarm, it does not appear on the 
display, however, audible alarms can still be heard while monitoring in 
the background. (For more information on alarms, refer to Chapter 5, 
“Working with Alarms.”) 
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KO To monitor the network in the background: 

VY sao oe 

NO, 1. Start the monitor and initiate a monitoring session as you normally 
would, following the instructions provided earlier in this chapter. 

2. Move to Exit on the monitor’s Main Menu and press Enter. 

The Main Selection Menu appears. The driver continues to monitor 
network traffic, but you can now perform other tasks. 
You might want to bring the monitor back to the foreground after a period of 
background monitoring, for example, to display statistics or alarms. 
KD To bring the monitor to the foreground: 
PY 1. Atthe DOS prompt, type MENU and press Enter. The Main Selection 
Menu appears. 

2. Select Token-Ring Monitor and press Enter. The Monitor Service Menu 
appears. 

3. Select Run the User Interface and press Enter. The monitor's 
Initialization screen appears. 

4. Press any key to display the monitor’s Main Menu. The key label for F10 
on the screen is “Stop monitor,” which indicates that the monitoring 
session is in progress. 

SA To stop a background monitoring session: 
PY 1. Bring the monitor to the foreground. 


2. From the monitor’s Main Menu, press F10 (Stop monitor). 


Alternatively, you can stop a background monitoring session and remove the 
driver at the same time. This procedure is described in the section, “Removing 
the Driver from Memory.” 


Removing the Driver from Memory 


The monitor’s driver program is loaded into memory when you start the 
monitor. To use the analyzer application, the driver must first be removed from 
memory. If you try to start the analyzer application without removing the 
monitor driver, you are prompted that the monitor driver will be removed from 
memory if you continue. 


KI To remove the driver from memory: 
wy 
1. Display the Sniffer Network Analyzer Main Selection Menu. 


2. Select Token-Ring Monitor and press Enter. The Token-Ring Monitor 
Selection Menu appears. 


3. Select Terminate Token-Ring Monitor and press Enter. The following 
messages appear: 


Removing the monitor driver from memory... 
TRMONDRV removed from memory 
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After a few seconds, the Main Selection Menu is displayed. 


= Removing the driver from memory terminates the monitoring session and 

erases from memory all statistics that the monitor has gathered. To save the 
statistics, you can print out or save a report to disk. For further information on 
report writing, refer to Chapter 6, “Creating Reports.” 
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CHAPTER THREE: DISPLAYING STATISTICS a 


General 


Displaying Statistics 


Overview 


This chapter describes how to display the statistics the monitor gathers during 
a monitoring session. You can choose what you see and how you see it. 
The following are examples of what you can display: 

¢ Traffic statistics for the entire network (global statistics) 

¢ Traffic statistics for a single station 


¢ Traffic statistics for every station on the network 
The monitor sorts all these statistics according to your specifications. 


This chapter describes the general display options and discusses the display for 
each type of statistic. For various types of information in each view, refer to 
Chapter 9, “The Monitor Menu Items.” 


Display Options 


A number of options are available for customizing statistical views. This section 
describes only the ones that apply to more than one type of statistic. More 
specific options (for example, Route path and Route length, which apply only 
to Routing info) are discussed in the sections that follow. 


The following is a list of general options that determine a statistical view’s 
contents and format: 


¢ Type of statistic to display (for example, Global statistics or Alarm 
log). 


¢ Format of the display (that is, whether statistics are displayed 
numerically or graphically). This applies to some types of statistics 
only. | 


¢ Class of traffic (that is, traffic to or from the station, or both). 


¢ Network usage (that is, relative or absolute). 


After you start monitoring, pressing F3 (Display) displays the statistics 
according to the options you specified. 


Numeric vs. Graphic Display 


You can configure the monitor to provide either a numeric or graphic display 
for the following types of statistics: 


¢ Global statistics 


¢ Single station 
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¢ All stations 
* Global history 


¢ Station history 


The numeric display consists of columns of numbers; the graphic display 
presents values in a histogram for a visual summary of network usage. 


For each graphic view, you can scale the usage axis using these methods: 


¢ Pressing F7 or Cursor Up scales up the axis, which makes the bars in the 
graph longer to show a greater level of detail. 


¢ Pressing F8 or Cursor Down scales down the axis, which makes the bars 
in the graph shorter. 


If a bar is longer than the axis, the monitor displays a triangle at the upper end 
of the bar. 


Class Option: To, From, or Both 


The Class option applies to the following types of statistics: 
¢ Single station (for the graphic display only) 
¢ All stations 


¢ Station history 


For each station, the Class option determines whether statistics are displayed 
for received frames (To), transmitted frames (From), or both (Both). 


Network Usage Option: Absolute vs. Relative 


The Network usage option applies to the following types of statistics: 
¢ Single station 
¢ All stations 


¢ Station history 


The Network usage option can be set to one of the following: 


Absolute Statistics are measured as a portion of the total network 
capacity, which remains constant. For example, if all 
stations together use 10% of the total capacity, absolute 
usage is 10%. 


Relative Statistics are measured as a portion of the total traffic. For 
example, if one station accounts for all the traffic on the 
network, its relative usage is 100%; if four stations 
generate traffic in equal amounts, relative usage for each 
is 25%. 


It is possible that a station accounts for a high percentage of relative network 
usage but a low percentage of absolute network usage. For example, if there are 


Freezing the Screen Display 


only two active stations on the network, which generate about the same amount 
of traffic, their relative usage is approximately 50% each. But if these stations 
rarely generate traffic, their absolute network usage can be as low as 1%. In this 
case, about 99% of the network capacity is unused. 


Only absolute network usage is displayed in global statistics views. The 
Relative option does not take effect, for example, when you display global 
statistics or global history. 


The value of network usage is rounded up to two decimals if it is less than 
0.01%. For example, the absolute network usage is 0.01% for a station that 
received and transmitted a total of two frames, although these frames did not 
use as much as 0.01% of the network capacity. 


If you choose the Both option in the Display \ Class menu, the relative network 
usage percentage can add up to 200% because the monitor counts each frame 
twice: once for the source address and once for the destination address. 


Freezing the Screen Display 


When a statistical view is displayed during a monitoring session, pressing F9 
(Freeze display) temporarily stops updates to the screen to make it easier to 
study specific statistics. The clock in the upper- right corner is stopped as well. 
In the background, however, the monitor continues collecting statistics, logging 
alarms, and generating reports (if these functions have been enabled). To 
redisplay the current statistics, press F9 again. 


Scrolling the Screen Display 


If there are more stations than a screen can contain in a view, use F3 (Prev 
station) or F4 (Next station) to view the previous or next station. In a numeric 
view, Cursor Up and Cursor Down perform the same function as F3 and F4, 
respectively. 


To look at the first screen of information, press Home; to look at the last screen, 
press End. 


Displaying Global Statistics 


The Global Statistics view displays traffic statistics for the entire network as they 
are updated, either in numeric or graphic format. 


Figure 3-1 is an example of the numeric Global Statistics view. The numeric 
view presents three categories of statistics: 


Traffic counts Counts on the left show the amount of cumulative activity 
since the beginning of the monitoring session. Counts on 
the right show activity during the last second. 
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Error counts 


Timestamps 


The Error Counts column indicates the overall condition 
of the network, the number of oversized frames, the 
number of ring purges, and the number of soft error 
report frames. For further information on error counts, 
refer to Chapter 9, “The Monitor Menu Items.” 


To check which stations report most of the soft error 
frames, select the All stations option in the Display menu 
once you return to the Main Menu. 


The timestamps include the time when monitoring 
started and the time when the first and last network 
activities took place. The monitor also shows the duration 
of a monitoring session. 


LOBAL STATISTICS ————A_—_—___——_———___— Oct @2 17:94:59 


Traffic Counts 


Maximum Inserted Stns Current Inserted Stns 


Total Stations 
Average Usage 
Total Frames 
Total Bytes 
Avg Frame Size 


Active Stations 
Current Usage 
Current Frames 
Current Bytes 
Avg Frame Size 


Error Counts Timestamps 


Ring State Operating Normally Monitor Started Oct 82 17:04:44 


Oversized Frames 
Ring Purges 
soft Error Reports 


Monitor Active 9% day(s) 00:68:15 
First Activity Oct 82 17:84:45 


Last Activity Oct @2 17:84:59 
Network Active @ day(s) 00:00:14 


fe) 6Disply 9Freezeffl9 Stop 
Menus foption displayfinonitor 


Figure 3-1. Global statistics (numeric view). 


Figure 3-2 is an example of the Global Statistics view in graphic format. As in 
the numeric view, the top portion of the graphic view shows traffic counts, both 
cumulative and for the last second. The bottom portion shows absolute network 
usage plotted as a graph and updated at one-second intervals. 


To display global statistics: 


1. 


Spacebar. 


Move to the Global statistics option in the Display menu and press the 


Move to the Numeric or Graphic option in the Display \ Global statistics 


menu and press the Spacebar. 


Press F3 (Display) to display the statistics. 


Displaying Station Statistics 


LOBAL STATISTICS ——_#§ ct 82 17:86:52 


Traffic Counts 


Maximum Inserted Stns Current Inserted Stns 
Total Stations Active Stations 
Average Usage ' Current Usage 

Total Frames , Current Frames 

Total Bytes , 828, Current Bytes 

Avg Frame Size Avg Frame Size 


4G 32 
Seconds 
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Figure 3-2. Global statistics (graphic view). 


Displaying Station Statistics 


The Single Station view displays traffic statistics to and from specific stations as 
they are updated, either in numeric or graphic format. 


In the numeric view, there are three columns: 


The top-left column identifies the station to which these statistics apply, 
as well as the station’s two most recent partners. 


The top-right column shows combined transmission and reception 
activity. The current usage percentage represents the usage during the 
past second; other statistics are cumulative since the beginning of the 
monitoring session. 


The lower-left portion shows transmission activity, and the lower-right 
portion shows reception activity. These portions show the same types 
of statistics, except that the lower-left portion includes the number of 
errors reported by the station. This error count is not included in the 
lower-right portion because soft error reports are not sent to individual 
stations. 


Figure 3-3 displays traffic to and from a single station. 


Transmission statistics are based on frames sent from the specified station; 
reception statistics are based on frames sent to the specified station. To illustrate 
this distinction, display the station statistics for the broadcast address. Since the 
broadcast address is only used as a destination address, you only see traffic in 
the “Traffic TO Station” category. 
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ABSOLUTE TRAFFIC STATISTICS-SINGLE STATION-—————~——————_ct. 82 17:22:57. 

Traffic TO and FROM Station 

Station: File Server Current Usage 

Status: Monitor Average Usage 

Total Frames 

Last sent to: Alex Zwick Total Errors 
Last rcv from: Ken Quinn Total Bytes 35,697 , 892 
Avg Frame Size 274 


Traffic FROM Station Traffic TO Station 


Current Usage 


1.90 % Current Usage 3.28 % 
Average Usage 1.50 % Average Usage 5.82 % 
Total Frames 64, 405 Total Frames 65,622 
Total Errors 24 
Total Bytes 8,258,712 Total Bytes 27,447,188 
Avg Frame Size 128 Avg Frame Size 418 
Start Time Oct @2 17:04:45 Start Time Oct @2 17:84:45 
End Time Oct @2 17:22:57 End Time Oct 82 17:22:57 
Elapsed ®@ day(s) 00:18:12 Elapsed O day(s) 00:18:12 


9 6Disply 9Freeze—il@ Stop 
Menus foptions displaygimonitor 


Figure 3-3. Traffic statistics for a single station (numeric view). 


In the graphic view, the top portion displays either receptions, transmissions, or 
both, depending on whether you selected To, From, or Both with the Class 
option. The bottom portion shows either absolute or relative network usage 
plotted as a graph and updated at one-second intervals. The bars in the graph 
also indicate the class of statistics. For example, on a color monitor, the yellow 
portion of the bar represents receptions, and the blue portion represents 
transmissions. Figure 3-4 shows a graphic view of statistics for a single station. 


To display station statistics: 


1. Move to the Single station option in the Display menu and press the 
Spacebar. 


2. Move to the Stn option in the Display \Single station menu and press 
Enter to display the station list. Move to the station you want to display 
statistics for and press Enter. 


3. Define how statistics are displayed. 
a. Move to the Numeric or Graphic option and press the Spacebar. 


b. To display the Class and Network usage options, press Cursor Left 
to move back to the Display menu. 


c. Press Page Down to move to Network usage. Then move to 
Absolute or Relative in the Display \Network usage menu, 
depending on whether you want to show statistics as a portion of 
total network capacity or current traffic. Press the Spacebar to select 
the option. 


Displaying Sorted Statistics for All Stations 


d. If you select the Graphic option, you can also define the Class 
options. Move to To, From, or Both in the Display \Class menu, 
depending on whether you want to display statistics for receptions, 
transmissions, or both. Press the Spacebar. 


4. Press F3 (Display) to display the statistics. 


ABSOLUTE TRAFFIC STATISTICS-SINGLE STATIONN-——————————_Oct. 82 17:31:24 
Traffic TO and FROM Station 
Station: File Server Current Usage 27.61 % 
Status: Monitor Average Usage 6.58 % 
Total Frames 195, 386 


Last sent to: Jill Franz Total Errors 33 
Last rcv from: Barney Ingram Total Bytes 92,647, 364 
Avg Frame Size 


Seconds 
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Figure 3—4. Traffic statistics for a single station (graphic view). 


Displaying Sorted Statistics for All Stations 


The statistical view for all stations contains various types of statistics for each 
station. You can customize the display by specifying the following in the Main 
Menu: 


* How the statistics are sorted 
¢ Whether the statistics are displayed in ascending or descending order 
¢ What statistics are displayed in the view 


¢ Whether the display is in numeric or graphic format 
Figure 3-5 shows a numeric example of sorted statistics that include the station, 
the number of frames, errors, bytes, average frame size, and the percentage of 


absolute network usage. These statistics are sorted in descending order by the 
number of bytes. 
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Sorting Statistics 
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Station Frames £E Bytes Size Usage 
File Server 276, 009 73,432,466 266 6.51 
Print Server 191,191 45,529,139 238 4,83 
18,011,113 919 1,59 
15,513,678 783 1.37 
15,013,438 774 1.33 
14,282,561 743 1.26 
9,822,593 508 9.87 
6,804,908 347 9.60 
6,011,525 306 9.53 
4,914,731 248 9.43 
2,748,389 148 9.24 
2,707,797 B24 
2,529, 836 G.22 
2,220,957 G.19 
2,220,898 §.19 
1,982,862 8.17 
1,947,272 Q.17 
1,796,588 6.15 


Denise Martin 19,580 
Mark Ellison 19,801 
Ed Hicks 19,389 
Linus Stanwick 19, 206 
Steven Anderson 19,264 
William Griffith 19,582 
Tom Brown 19,623 
Michael Harley 19, 89 
Miles Russell 19,575 
Barbara Lemmon 19,565 
Bill Goodman 19,619 
Barney Ingram 28,825 
Ken Quinn 19,201 
Alex Zwick 19,715 
Helene Milici 19,558 
George Stanley 19,991 
Jill Franz 20 , 066 1,725,889 6.15 
Robert Hayes 19,695 1,441,699 G.12 


20 
1 Cieac\) Cache © 6Disply 9Freezegii@ Stop 
tee) stationffstationfj Menus foptions displauyfimonitor 


Figure 3-5. Traffic statistics for all stations (numeric view). 
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The monitor can sort statistics in a variety of ways. This is useful for comparing 
stations or for finding stations that match certain criteria. The following is a list 
of sort keys for both numeric and graphic displays: 


Name Name of the station. If a station is not named, the address 
is used. 

Partner’s name Last station that communicated with the station. 

Ring order Order in which the stations are located on the Token-Ring 
network. 

Frames Total number of frames transmitted or received, or both 


transmitted and received during a monitoring session. 


Errors Total number of soft error report frames transmitted. (If 
the setting of the Class option is To, you are not allowed 
to sort by errors.) 


Bytes Total number of bytes transmitted, received, or both. 
Average size Average size of frames transmitted, received, or both. 
Network usage Percentage of network usage. 

First activity Time when the first frame was sent or received. 

Last activity Time when the most recent frame was sent or received. 
Elapsed activity Time between the first and last activity. 


Displaying Sorted Statistics for All Stations 


Types of Statistics Included in the View 


The Display \ All stations menu includes two options that limit the displayed 
statistics to particular stations, whether you select the numeric or graphic 
format: 


Active stns only Stations that have sent or received frames on the network 
since the monitoring session started. 


Inserted stns only Stations whose station status is active monitor, standby 
monitor, or snooper. (For further information on station 
status, refer to the section “ All Stations Statistics in 
Numeric Format” on page 9-16.) 


If both options are selected, a station, to be included in the view, must be an 
inserted station that has sent or received frames; if neither option is selected, all 
stations are included. 


If you select the numeric format, you can also select the types of statistics to be 
included in the display. The following list contains the statistic types. Most of 

the items in the list are the same as the sort keys. Refer to the previous section 

“Sorting Statistics” for information on those statistic types. 


¢ Partner’s name 


¢ Station status (For further information on station status, refer to the 
section “All Stations Statistics in Numeric Format” on page 9-16.) 


¢ Frames 
¢ Errors 
* Bytes 


* Average size 
* Network usage 
¢ First activity 
* Last activity 
* Elapsed activity 
[ If you select more options than can fit in the statistical view, use Cursor Left or 
Se 


Cursor Right to scroll hidden portions of the screen into view. Pressing Control 
and a cursor key moves you to the far right or left of any screen. 


Numeric vs. Graphic Display 


The numeric display can include various types of statistics according to your 
specification. Refer to the “Types of Statistics Included in the View” section for 
more information. 


The graphic display shows the network usage of up to 10 stations at a time. The 
percentages are represented both graphically and numerically. To see more 
than the 10 stations, press Cursor Right or Cursor Left. 


[Network| 3-11 


Sniffer Network Analyzer: Token-Ring Monitor Operations 


The graphic display also indicates the class of traffic from which the statistics 
are derived. Specify the value of the Class option (To, From, or Both) in the 
Display \Class menu. 


Figure 3-6, for example, shows the stations with the highest amount of relative 
network usage for both transmissions and receptions. The statistics below the 
graph are derived from the transmission and reception counts, while the graph 
shows all three classes (To, From, and Both) for each of the listed stations. 


RELATIVE TRAFFIC STATISTICS TO AND FROM STATIONS-————————Oct @2 18:82:3 
10 pAAAAAA~AA—AA—AAAA——AA——AAAA—AAAA 


8 


oan ” C&C  @ 


4 5 6 7 
Legend: To FROM BOTH 
File Server 61.15 % 6 Linus Stanwick 
Print Server 38.60 % 7 Steven Anderson 
Denise Martin 14.95 % 8 William Griffith 


Mark Ellison 12.95 % 9 Tom Brown 
Ed Hicks 12.48 % 18 Michael Harley 


re 
1 , Saal) Vemchad © 6Displu—i/ Scalefi8 Scale—i9Freeze™li™ Stop 
Help stationfistation§ Menus f™options™ up down idisplau—imonitor 


Figure 3-6. Traffic statistics for all stations (graphic view). 


Procedure for Displaying Statistics for All Stations 


KZ To display and sort selected statistics: 
© 
1. Move to All stations in the Display menu and press the Spacebar. 


2. Follow these steps to define the type of traffic and network usage: 
a. Press C to move to the Class option. 


b. Move to To, From, or Both in the Display \Class menu. Press the 
Spacebar to select one of the options. 


c. Move to the Display \ Network usage menu. Press the Spacebar to 
select either Absolute or Relative. 


3. To specify the format of the display, move to the Numeric or Graphic 
option in the Display \ All stations menu and press the Spacebar. 


4. Ifyouselect Numeric, a list appears in the right panel, which allows you 
to select the types of statistics to be included in the view. Move to any 
options in the list and press the Spacebar to select the options. 
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Displaying Frame Sizes 


5. To specify how the statistics are sorted, move to Sort by in the 
Display \ All stations menu. Two lists of options appear to its right. 


a. Move to the Ascending or Descending option in the first list and 
press the Spacebar. 


b. Move to the sort key displayed in the second list and press the 
Spacebar. 


For example, if you select Frames, the monitor sorts all stations by 
the number of frames and displays them from highest to lowest or 
vice versa, depending on whether you chose the Descending or 
Ascending option. 


6. To specify the types of stations to be included in the view, move to the 
Display \All stations menu. 


If you want the view to include only the stations that have sent or 
received traffic, select Active stns only. 


If you want the view to include only the inserted stations, select Inserted 
stn only. 


7. Press F3 (Display) to display the sorted statistics you specified. If there 
are too many options to fit on the screen in the numeric view, use Cursor 
Right or Cursor Left to scroll them into view. 


To display stations either higher or lower in the sort order, press F3 (Prev 
station) or F4 (Next station). 


Displaying Frame Sizes 


This view shows how many frames fall into each of the predefined size 
categories and what percentage of frames each size category comprises. The 
graph illustrates these numbers for a visual summary. This information is 
useful for determining how to configure your network’s data buffers. 
Figure 3-7 is an example of the Frame Sizes view on a 4-Mb/s network. 


y 


To display frame sizes: 


‘g 
ve 


1. Move to Frame sizes in the Display menu and press the Spacebar. 


2. Press F3 (Display) to display the frame size distribution. 
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FRAME S1ZES——A_____—__—___—_Oct #2 18:08:58 


Size Frames Percent 9 4g 60 82 100 


Under 17 i) 
6.00 

26.55 

33- 21.82 
65- ; 20.77 
129- 15.45 
257- 5.87 
513- 1924 ; 2.39 
1925- 2048 5.69 
2049- 4296 ; 2.53 
4097- 4628 6.60 
Over 4628 0 00 


9Freeze—il™ Stop 
displaujfimonitor 
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Figure 3-7. Frame sizes view. 


Displaying Routing Information 


The monitor provides two views that contain routing information. The Routing 
Paths view shows the amount of traffic routed to and from the local ring. The 
Routing Lengths view breaks down the number of routed frames by the length 
of the route, which is equal to the number of Token-Ring bridges a frame has 
traversed. 


Figure 3-8 and Figure 3-9 are examples of the Routing Paths view and Routing 
Lengths view at a given time. 


KZ To display routing information: 
YY 
1. Move to Routing info in the Display menu and press the Spacebar. 


2. Move to Route path or Route length in the Display \ Routing info menu 
and press the Spacebar. 


3. Press F3 (Display) to display the routing information. 
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Displaying Routing Information 


ROUTING PATHS-—————_ ENDED: Oct 38 15:05:2 
Routed frames: 4,756 22.52% 
Non-Routed frames: 16,359 77.47% 


Frames to remote rings 
Local ring== 2,158 Remote ring 


Frames on 10.18% Frames passing 
this local ring through local ring 


16,359 Frames from remote rings 553 
1,929 2.61% 


Q 00% 
- To broadcast destinations 
- To group/functional destinations 
- To non-transmitting stations 
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Figure 3-8. Routing Paths view. 


ROUTING LENGTHS -———t——__—_ ENDED: Oct 30 15:85:2 
Length Frames Percent @ 62 82 128 


QB 0.28 
2,404 58.54 
1,675 35.21 

993s 11.62 
0.08 
D.08 
0.00 


oO CON OD OTB GO DP S&S 


All Routes 
Other 


_—s 
BO 
QVHLAQ&ele—k VQ VQVQWQQ SI 


Total 4,756 22.52 % of all frames on local ring are routed 
9  @6Disply 9FreezefiiG New 
Menus foptions displayfinmonitor 


Figure 3-9. Routing Lengths view. 
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Displaying Protocols 
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This view shows a distribution of protocol types used on the network. The 
number and percentage of either bytes or frames can be displayed for all: 


¢ SAP (Service Access Point) protocol types 
¢ Ethertypes (in SNAP SAP) embedded in the type field 


The percentages indicate how the frames or bytes are distributed among the 
protocol types monitored. The view also illustrates these numbers in a bar 


graph. 


For both the Ethertypes and SAP protocol types views, you can choose to 
display the number of bytes or frames on the network. For the Ethertypes view, 
you can choose to display the percentages based on all frames counted or on 
only SNAP frames counted. (When displaying the number of bytes, the 
percentages are based on the number of bytes in either all frames counted or 
only the SNAP frames counted.) 


Figure 3-10 and Figure 3-11 are examples of the Display Protocol view (SAPs 
and Ethertypes) that show the distribution of bytes by protocol type. 


The monitor reads the STARTUP.TRT file for the SAP values. If you want 
breakdowns for protocol types other than those shown, use the DOS command, 
EDLIN, to add protocols to STARTUP.TRT. The file can contain up to 64 entries 
(32 SAP and 32 Ethertype). The maximum number of labels for each type (SAP 
and Ethertype) is 16. Each label can have 4 SAP numbers. 


For information on SAP, refer to the Token-Ring Network, Architecture Reference. 


To display the SAP protocol type view: 
1. Move to Protocols in the Display menu and press the Spacebar. 
2. Move to SAP Protocols and press the Spacebar. 
3. Move to the Bytes or Frames option and press the Spacebar. 


4. Press F3 (Display) to display the Protocol Types (SAPs) view. 
To display the Ethertype view: 


Move to Protocols in the Display menu and press the Spacebar. 
Move to Ethertype Protocol and press the Spacebar. 


Move to the Bytes or Frames option and press the Spacebar. 


ee Se 


Move to the All Frames or SNAP Frames option and press the Spacebar. 
(Percentages are based on either all frames or SNAP frames.) 


5. Press F3 (Display) to display the Protocol Types (SAPs) view. 


Displaying Protocols 


PROTOCOL TYPES (SAPS) 93 15:28:22 
SAP Bytes Total @ 20 49 60 80 108 


3,646,953 12.95 
2,016, 468 7.16 
8,411,349 29.86 
271,416 #.96 
5,981,558 21.24 
2,278, 766 8.29 
i] 8.08 

133, 866 @.47 
251,949 0.89 
113, 882 g.42 
63,231 8.22 
1,860, 642 6.60 
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Figure 3-10. SAP Protocol Types view. 


PROTOCOL TYPES CETHERTYPES) 
Ethertype Bytes Total @ 


IP 3,646,953 12,95 
ARP g i) 
AARP 8.20 
RARP ie) 
ATALK 8.88 
Banyan i )) 
DECNET 5,916,549 29.86 
LAT g 9.0 
LAYC 133, 866 0.47 
LANBrdg ) 0.28 
XNS ) 8.80 
822.3 ') es) 
Other 1,868,640 6.62 


(Percentages are based on all frames) 
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Figure 3-11. Ethertypes Protocol Types view. 
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Displaying the Alarm Log 


The Alarm Log view shows the alarms in the alarm buffer. Figure 3-12 is an 
example of the Alarm Log view. 


0 0 —— ee 26-165 35:42 


Critical 


Critical 
Warning 
Warning 
Warning 
Critical 
Warning 
Minor 
Warning 
Major 
Major 
Minor 
Warning 


1 
iewae) 


Oct 26 19:49:39 


15:58:15 
15:58:17 
15:51:04 
15:51:45 
16:82:18 
16:89:19 
16:15:59 
16:17:93 
16:17:51 
16:20:17 
16:23:16 
16:23:34 
16:24:24 
16:24:30 
16:29:58 
16:31:16 
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alarm § alarm § Menus options 


Figure 3-12, Alarm Log view. 


Global movers 


Denise Mart in 
Mark Ellison 
Barbara Lemmon 
George Stanley 
File Server 
Anthony Serrao 
Jill Franz 
Robert Hayes 
Print Server 
Ken Quinn 

Alex Zwick 
Linus Stanwick 
Miles Russell 
James Wylie 
Jack Clayton 
Fred Biddle 


Type/Description Ack 
Abs usage exceeded 25% 
Rel usage exceeded 5% 
Rel usage exceeded 12% 
Rel usage exceeded 5% 

5 or more error reports 
5 or more error reports 
25 or more error reports 
5 or more error reports 
5 or more error reports 
5 or more error reports 
25 or more error reports 
5 or more error reports 
5 or more error reports 
5 or more error reports 
5 or more error reports 
5 or more error reports 
5 or more error reports 
5 or more error reports 


18 Stop 
monitor 


When the Alarm Log view is displayed, you can do the following: 


* Use Cursor Up or Cursor Down to highlight any alarm. Then 
acknowledge the highlighted alarm by pressing F3 (Ack alarm), which 


puts a V mark in the right column. 


¢ Clear the alarm by pressing F4 (Clear alarm), which deletes it from the 
alarm buffer. (For a complete discussion of alarms and the alarm buffer, 
see Chapter 5, “Working with Alarms.”) 


ON To display the alarm log: 
RY i 


Move to Alarm log in the Display menu and press the Spacebar. 


2. Press F3 (Display). The Alarm Log view appears. 


Displaying Global History Statistics 
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The statistics in this view show the amount of network activity and number of 
soft error report frames during each history interval. (You can specify the length 
of the history interval; refer to the section “History” on page 9-5 for further 
information on the History option.) The monitor can collect history statistics for 
up to 1,024 history intervals. History statistics are particularly useful for 
troubleshooting and network maintenance tasks, such as determining periods 
of low activity to schedule downtime. 


Displaying Global History Statistics 


History statistics are erased from memory when you start a new monitoring 
session or when you change the history interval during a monitoring session. 


The numeric view (Figure 3-13) shows the following types of information for 
each interval: 


¢ Interval number 

* Timestamp 

* Number of frames, errors, and bytes 
* Average frame size 


* Percentage of absolute network usage 


Time Bytes Size Usage 


21 Oct 26 16:36:43 17, 468 4,533,409 259 7.75 

p 16:34:43 28,984 7,229,993 249 12.38 
16:32:43 24,326 0,747,665 236 9.86 
16:30:43 22, 886 5,740,709 258 9.83 
16:28:43 24,973 6,687,986 267 11.43 
16:26:43 25, 269 6,382,022 254 16.92 
16:24:43 26,788 6,407,811 239 18.99 
16:22:43 25, 63 6,971,694 262 11.24 
16:28:43 25,359 6,205,828 244 18.63 
16:18:43 24,168 6,148,575 254 18.51 
16:16:43 26,289 6,781,064 257 11.62 
16:14:43 26, 366 6,715,119 254 11.49 
16:12:43 26,969 6,152,979 228 18.56 
16:18:43 26,091 6,911,299 249 11.15 M 
16:08: 43 22,652 5,913,472 243 9.450 
16:26:43 26,378 6,995,404 258 11.38r 
16:84:43 24,485 6,095,834 248 18.44 .e 
16:82:43 22,415 9,471,446 244 9,381 


Figure 3-13. Global history statistics (numeric view). 


The graphic view (Figure 3-14) shows the following types of information: 
¢ Interval number 
¢ Timestamp 


¢ Percentage of absolute network usage in numeric and graphic formats 


KA To display global history statistics: 
LOA 1. Move to Global history in the Display menu and press the Spacebar. 


2. Move to the Numeric or Graphic option in the Display \ Global history 
menu and press the Spacebar. 


3. Press F3 (Display) to display the history statistics. 


Press F3 (View earlier) or F4 (View later) to view intervals recorded earlier or 
later. 
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LOBAL HISTORY STATISTICS Ot 26 16:38:18 
Time Usage 9 4 8 12 16 26 


21 Oct 26 16:36:43 7.75 
20 16:34:43 12.38 
16:32:43 9 86 
16:38:43 9.83 
16:28:43 11.43 
16:26:43 18.92 
16:24:43 18.99 
16:22:43 11.24 
16:20: 43 
16:18:43 
16:16:43 
16:14:43 
16:12:43 
16:18:43 
16:28:43 
16:26:43 
16:24: 43 
16:02:43 


3 ViewE4d Views 6Disply—fi/ Scale—i8 Scale 18 Stop 
earlier§ later§{ Menus ffoptions™ up down monitor 


Figure 3-14. Global history statistics (graphic view). 


Displaying Station History Statistics 
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The monitor collects and displays history statistics for the station you specified 
with the Stn option in the History menu. 


Although the numeric and graphic Station History views include the same 
types of information as the Global History views, you can customize the Station 
History views further to show whether: 


¢ History statistics include transmissions, receptions, or both 


¢ Network usage shown is absolute or relative 


You can collect station history statistics for only one station at a time. Also, 
history statistics are erased when you start a new monitoring session or if you 
change the history interval during a monitoring session. If you need to save 
them, generate a report or save them to disk. (Refer to “Generating a Report” on 
page 6-16 for information on creating reports; refer to “History” on page 9-5 for 
information on saving history statistics to disk.) 


Figure 3-15 and Figure 3-16 illustrate the history statistics for the station “File 
Server” in numeric and graphic formats, respectively. They both show the 
station’s transmission and reception traffic compared to the network capacity 
(that is, absolute network usage). 


Displaying Station History Statistics 


ABSOLUTE HISTORY STATISTICS TO AND FROM File Server-——————Oct 26 16:39:26 
Time Frames rrs Bytes Size Usage 


T! 


22 Oct 26 16:38:43 3,825 931,393 243 
16:36:43 18,513 3 2,962,188 281 
16:34:43 16,919 4,437,814 262 
16:32:43 14,263 3,281,848 
16:38:43 13,286 3,452,364 
16:28:43 14,555 4,179,546 
16:26:43 14,674 3,939, 038 
16:24:43 15,689 3,772,781 
16:22:43 14,594 3,987,243 
16:20:43 14,588 3,778, 333 
16:18:43 14,230 3,814,111 
16:16:43 15,392 4,395, 063 
16:14:43 15,524 4,036,815 
16:12:43 15,719 3,773,153 
16:18:43 15,254 3,941,129 
16:28:43 13,172 3,478, 488 
16:86: 43 15,284 4,070,686 
16:24:43 14,325 3,718,770 
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Figure 3-15. History statistics for “File Server” (numeric view). 
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Time Usage @ 2 4 6 8 19 


22 Oct 26 16:38:43 1.59 
16:36:43 5 05 
16:34:43 7.59 
16:32:43 5.58 
16:38:43 5.96 
16:28:43 7.13 
16:26:43 6.73 
16:24:43 6.47 
16:22:43 6.81 
16:26:43 6. 46 
16:18:43 6.52 
16:16:43 7.50 
16:14:43 6.99 
16:12:43 6.47 
16:19: 43 6.74 
16:98:43 5.93 
16:06: 43 6.96 


ABSOLUTE HISTORY STATISTICS TO AND FROM File Server-——————Oct 26 
M 
0 
r 
e 
16:04:43 6.35 4 


3 View—4d View—d 6Displyufi/ Scaleff8 Scale 18 Stop 
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Figure 3-16. History statistics for “File Server” (graphic view). 


3-21 


Sniffer Network Analyzer: Token-Ring Monitor Operations 


KD To display the station history: 
KOZ 1. Move to Station history in the Display menu and press the Spacebar. 


2. Define how statistics are displayed. 


a. Move to the Numeric or Graphic option in the Display \Station 
history menu and press the Spacebar. 


b. Move back to the Display menu, and press C to select the Class 
option. 


c. Move to To, From, or Both, depending on whether you want to 
display statistics for receptions, transmissions, or both. Press the 
Spacebar. 


d. Move to Network usage in the Display menu, and then to either 
Absolute or Relative, depending on whether you want to show 
statistics as a portion of the total network capacity or as a portion of 
the current total traffic. Press the Spacebar. 


3. Press F3 (Display) to display the history for a selected station. 


Press F3 (View earlier) or F4 (View later) to view intervals recorded earlier or 
later. 
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CHAPTER FOUR: MANAGING THE STATION DATA FILES | 


General 


Managing the Station Data Files 


Overview 


The station data files in the C:\TRSNIFF directory contain station-specific 
information. The STARTUP.TRD file contains station addresses and names. The 
STARTUP.TRA file contains the alarm thresholds for each station; it is created 
the first time you change station information. (For further information on 
alarms, refer to Chapter 5, “Working with Alarms.”) As the monitor observes 
the network, it modifies these files by adding addresses that have been named. 
The monitor also assigns the default station alarm settings to these stations. 


The analyzer and monitor use the same name file. They can modify 
STARTUP.TRD, and the change affects the operations of both. For further 
information on how the analyzer uses or changes the name file, refer to the 
Sniffer Network Analyzer: Analyzer Operations manual. 


You can add stations manually by editing STARTUP.TRD with the DOS 
command, EDLIN. This lets you name stations that are not yet active on the 
network. 


This chapter describes how you customize the settings associated with each 
station in the data files. The description includes: 


¢ Displaying station information 

¢ Identifying stations 

¢ Assigning names 

¢ Assigning station alarm thresholds 
¢ Deleting stations 


¢ Returning to an earlier version of the data file 


Displaying and Editing Station Information 


The Edit option in the Manage station menu displays the Manage Station 
Information view (Figure 4-1), in which you modify the station data files. Any 
changes you make are automatically saved when you exit this view. You can 
also display the Manage Station Information view by choosing Edit in the 
Alarm menu. 


The monitor automatically creates a backup copy of each data file the first time 
you modify it after starting the monitor. The backup data files are named 
BACKUP.TRD and BACKUP.TRA, and are stored in the C:\ TRSNIFF directory. 
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ANAGE STATION INFORMATION 


anneal 


AOO0NAE3 400 
020200453106 
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Figure 4-1. Manage Station Information view. 


How the Monitor Identifies Stations 


4—4 


The monitor identifies stations by examining the 12-character strings that form 
the station addresses. You should assign names to station addresses for the 
following reasons: 


* Ina statistical view, names are easier to identify than addresses. 


* You cannot save changes to station alarm thresholds for unnamed 
stations. 


¢ Unnamed stations are deleted from the station list if you remove the 
monitor’s driver program from memory. 


¢ Unnamed stations trigger alarms when they generate traffic. If you do 
not assign names to the stations, you are unable to tell whether an alarm 
has been caused by an unnamed station, an intruder, or a network 
problem. (Refer to Chapter 5, “Working with Alarms,” for further 
information on unknown station alarms.) 


If the address of an unnamed station is specified in any menu item before you 
remove the monitor driver from memory, the monitor keeps the address in the 
station list the next time you start the monitor. For example, if the Stn option in 
the Monitor filters menu is set to 000000123456 before you remove the monitor 
driver from memory, this address remains in the station list the next time you 
run the monitor. The address is also included in the USERLIST report and the 
Manage Station Information view. Such an address, although unnamed, does 
not cause an unknown station alarm. 


Editing Station Information 


The section, “Editing Station Information,” describes different ways of naming 
stations. 


Editing Station Information 


Editing station information involves assigning names and alarm thresholds. 
After you assign station names, these names identify the stations in other views. 


Naming Stations Automatically 


If you installed a second network interface card that runs NetBIOS software, 
and if the stations you want to name are active and are running NetBIOS, you 
can name them automatically. This feature saves you considerable time. 


we To name stations automatically with NetBIOS: 
LY 1. Move to Manage stations in the Main Menu. 
2. Move to the Probe for names option and press Enter. 


Naming Stations Manually 


NetBIOS transmits a query to each unnamed address in the station list, 
and the monitor displays messages about the query. For example, for the 
unnamed address “IBM 788172,” the monitor displays this message: 


Attempting to name IBM 788172 


If the unnamed station does not respond, the monitor displays this 
message: 


IBM 788172 did not respond 


If it receives a response, the monitor assigns a name to the station. After 
the monitor has finished the naming process, the message “Done” 
appears. To interrupt the process, press Esc. 


Before naming stations, you must determine which address belongs to which 
station. The USERLIST report helps you identify all stations on the network. 
After knowing what stations exist on the network, you can add the names via 
the Manage Station Information view. 


Generating the USERLIST Report 


To run the USERLIST report: 

1. Monitor activity for several hours. 

2. Move to Report in the Main Menu. Then select the Load option. 

3. A window containing a list of reports appears. Move to USERLIST.SCR 
and press Enter. The monitor displays the information message, “Loading 
report script,” and returns to the Main Menu. 

4. Move to the Report\Print menu. 
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5. To view the station addresses on screen, select the Screen option. You 
can also print out the station list by selecting LPT1 or LPT2. For further 
information on printing a report, refer to the section “Printing a Report 
Manually” on page 6-17. 


6. Press Cursor Left to move back to the Print option. Press Enter to print 
the USERLIST report. It contains a list of station addresses detected by 
the monitor and the corresponding names. If an address is unnamed, the 
address itself appears in the name field. For each unnamed address, 
write down a name you want to assign to it. You will need the name 
when following the instructions in the next section. 


Naming a Station in the Manage Station Information View 
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ir 
X 


yy 


The Manage Station Information view contains alarm threshold information for 
all the stations listed in the USERLIST report. You can name a station or change 
an alarm threshold for a station in this view. 


To move to a station, use Cursor Up and Cursor Down. You can also type the 

first character of a station name or address to move to the station. However, if a 
station is named, you must type the first character of the name. For example, if 
the address “C00000000010” is named “Error monitor,” typing E selects it, but 
typing C does not. If the address “000065333333” is unnamed, press 0 to select it. 


To name a station: 
1. Move to Manage stations in the Main Menu. 


2. Move to the Edit option and press Enter to display the Manage Station 
Information view. 


3. Move to the station you want to name and press Enter. A dialog box 
appears with a list of the fields you can edit, as shown in the example in 
Figure 4-2. 


4. Move to the Name field and press Enter. Another dialog box appears. 


Type the station name in the dialog box. Station names can be up to 16 
characters long; all printable characters are allowed. After you finish 
typing, press Enter. 


6. To return to the Manage Station Information view, press F6 (Return); to 
change other values in the dialog box, go to the next section, “Changing 
Station Alarm Thresholds.” 


The name is saved automatically when you exit the Manage Station Information 
view. 


The Manage Station Information view alphabetizes the stations according to the 
station names. If a station does not have a name, its address is used for sorting. 
For example, the unnamed address “IBM 784B1A” is listed after the station 
named “Error Monitor” and before the station named “LAN Manager.” Also, 
numerals are listed before letters. For example, the unnamed address 
“000065333333” appears before the station named “ Active Monitor.” 


Changing Station Alarm Thresholds 


The stations may not be in the correct alphabetical order immediately after you 
edited the names. You can see the sorted names only after you exit the view and 
then display it again. 


ANAGE STATION INFORMATION 


C0C0004E0652 


QELALG4E3 408 
Q002084E3106 
Q2L0004E7 256 
POOLLB4ES5298 
QPOOB04E2001 
PEOROB4E21008 
0002004E 4302 
O200004E3504 
P2C2004EB005 
B2O2004EB062 
92020047506 
Q200004E3249 
Q002004E2301 
0200004E0654 
POBBOB4EG12 
920000454523 
020200453096 


No Rsp 


Name Errors 

Anthony Serrao 

Barbara Lemmon 

Barney Ingram 

Bill Goodman 

David Brooks 

DrSTATION @220004E9652 
Name = 
Errors = 25 
No response = 5 
Idle = Off 


Relative usage = 25 %* d# 


Priority = Warning d 
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Ken Quinn 
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Q000004E8347 Miles Russell Warning 


5 
se ft and | then press ENTER-——————————_-—_ 


Return 


Figure 4-2. Dialog box for editing station information. 


Changing Station Alarm Thresholds 


In the Manage Station Information view, you can display a dialog box for 
editing station alarm thresholds as shown in Figure 4~2. For further information 
on alarms, refer to Chapter 5, “Working with Alarms.” Be sure to follow the 
guidelines in that chapter when changing alarm thresholds. 


To change the station alarm thresholds: 


1. Move to the Edit option in the Manage stations menu and press Enter. 
The Manage Station Information view appears. 


2. Move to the station whose settings you want to change and press Enter. 
A dialog box appears with a list of fields you can edit. 

3. Move to the desired field and press Enter to display an additional dialog 
box. Select or type a value and press Enter. For example, in Figure 4-3, a 
list of possible Errors threshold settings is displayed. 

Repeat this step for each threshold setting for the selected station. 

4. Press F6 (Return) to return to the Manage Station Information view. 

5. Repeat steps 2, 3, and 4 for all the stations you want to edit. 


Changing alarm thresholds during a monitoring session can lead to unexpected 
results. For example, if you change a threshold that has already triggered an 
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alarm, no new alarm is triggered when the new threshold is reached. Therefore, 
it is best to make any changes before you start monitoring. 


ANAGE STATION INFORMATIO 

Address Name Errors No Rsp “Usage Priorit 
Q00C004E0303 Anthony Serrao 29 5 29 Warning 
DOO0R04E 3400 Barbara Lemmon pLRROK Warning 
Q000004E3106 Barney Ingram | Off Warning 
QQ00204E7256 Bill Goodman | Warning 


962020455298 
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Q000B4E21 08 
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Q202004E0120 


David Brooks 
Denise Martin 
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Linus Stanwick 
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Warning 
Warning 
Warning 
Warning 
Warning 
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Warning 
Warning 
Warning 
Warning 
Warning 


: : 5 
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Figure 4—3. Errors threshold for station alarms. 


Global Alarm Thresholds and Default Station Alarm Thresholds 


Deleting Stations 


= 


When the Manage Station Information view is displayed, you can change other 
alarm thresholds in addition to the ones described in the previous section. For 
example, press F6 to reset the station alarm thresholds to the default settings, or 
F7 to change the global alarm thresholds and station default thresholds. You can 
also change these settings with Alarms in the monitor’s Main Menu. For more 
information on thresholds and how to change them, refer to Chapter 5, 
“Working with Alarms.” 


You can delete stations from the Manage Station Information view. The changes 
are made to STARTUP.TRD and STARTUP.TRA as soon as you exit the Manage 
Station Information view. 


To avoid unpredictable results, stop the monitor before deleting a station. Ifa 
monitoring session is in progress and the Manage Station Information view is 
displayed, press F5 to go to the Main Menu. Then press F10 to stop the monitor. 
(F10 is labeled New monitor on the screen when the monitor is off.) 


If the monitor detects the station that you have deleted, it generates an 
unknown station alarm (provided that this type of alarm is enabled). 


Saving Alarm Threshold Information 


& To delete a station: 
1. Move to Manage stations in the Main Menu. 


2. Move to the Edit option and press Enter. The Manage Station 
Information view appears. 


3. Move to the station you want to delete and press F4 (Delete station). 


Saving Alarm Threshold Information 


When you make a change in the Manage Stations Information view, the change 
is saved to the STARTUP.TRA and STARTUP.TRD files as soon as you exit the 
view. The first time you modify these files after starting the monitor, the 
monitor creates backup copies of these files (BACKUP.TRA and BACKUP.TRD) 
so that you can always return to the previous station data files. 


You can save the station information (station names, addresses, and alarm 
thresholds) of specific networks (or segments) by copying the STARTUP.TRA 
and STARTUP.TRD files for each network. This is a convenient way to retain 
station information when the Sniffer Network Analyzer is moved from one 
network, or network segment, to another. For example, you could copy the files 
to NET1.TRA and NETI.TRD. To restore the station information of NET1, copy 
the files NET1.TRA and NET1.TRD to STARTUP.TRA and STARTUP.TRD 
before booting up the Sniffer Network Analyzer. 


y 


A To return to the previous station data files: 


A 
X 


1. Move to Exit in the Main Menu and press Enter. The Main Selection 
Menu appears. 


2. Select the Return to DOS option. The DOS prompt appears. 
3. Change directory to C:\TRSNIFF. 


4, Type COPY BACKUP.TRA STARTUP.TRA at the DOS prompt and then 
press Enter. | 


5. Type COPY BACKUP.TRD STARTUP.TRD at the DOS prompt and then 
press Enter. 


6. Toreturn to the Main Selection Menu, type MENU at the DOS prompt. 


The next time you start the monitor, it uses the settings that were in the station 
data files before they were changed. 
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CHAPTER FIVE: WORKING WITH ALARMS -" 


Network 
General 


Working with Alarms 


Overview 


This chapter explains how alarms work and describes how to use them. It 
includes instructions for the following tasks: 


¢ Changing alarm thresholds 

¢ Displaying the alarm log 

¢ Acknowledging and clearing alarms 
* Printing alarms 


¢ Saving alarms to disk 


Overview of Alarms 


Figure 5-1 shows how the monitor processes alarms. 


Alarm 1 


Thresholds Alarm 
“ee% Selection 
| Alarm 
Buffer 


(up to 200 alarms) 


O 

oO Oo 
Oo Oo 
oO O 
oO oO 
oO O 
oO oO 
Oo .°) 
oO .e) 
Oo oO 
OLE oO 


Alarm 200 


Unlimited Listing 


% 
srereceteterens 


4 


ALARM.LOG 


Figure 5-1. Alarm processing. 


When a measured network parameter (for example, the amount of idle time or 
the number of soft error frames) exceeds a predefined threshold, the monitor 
triggers an alarm and sends it to the alarm buffer. You can display the alarms in 
the buffer, save them to the disk, or print them on a printer. 
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Alarm Thresholds 


The monitor is shipped with threshold settings for the entire network and for 
individual stations. You can change both the global and station threshold 
settings. For station thresholds, you can change these settings: 


¢ Thresholds for stations that are already on the network 


¢ Default thresholds that will be assigned to new stations when they are 
detected 


The monitor generates three global alarms for which you cannot set thresholds. 
These alarms are explained in the section “Global Alarms” below. 


Priority Levels of Alarms 


Global Alarms 
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You can assign a priority level to each station on the network, which represents 
the importance of the alarms the station causes. You can also assign a priority 
level to each global alarm. The priority levels are: 


¢ Inform 


¢ Warning 


¢ Minor 
¢ Major 
¢ Critical 


An “Inform” alarm is the least important, and a “Critical” alarm is the most 
important. For example, if you consider the file server an important station on 
the network, you can specify that the alarms caused by the file server are labeled 
Critical. In this way, you can easily distinguish the more important alarms from 
others when viewing the alarm log. 


The alarm priority levels also correspond to the audible alarm levels. For more 
information on audible alarms refer to “Setting Audible Alarm Thresholds” on 
page 5-15 


The Token-Ring Monitor generates eight global alarms. Each global alarm can 
be turned on or off independently of the others. For each global alarm, you can 
set the priority level. For all global alarms, except “Unknown station,” 
“Oversized frame,” and “Active Poll fail,” you can set a threshold and a time 
interval to which the threshold applies. 


Alarms are generated when counts exceed the thresholds. For example, after 
you set the Frame errors threshold to 100 and the interval to 60 seconds, the 
monitor triggers an alarm if it detects 100 or more frames with errors during 
each 60-second period. The eight global alarms are (see Figure 5-2): 


Unknown station 


Oversized frame 


Broadcast storm 


Network idle 


Network usage 


Soft error reports 


Ring beaconing 


Active Poll fail 


Global Alarms 


Generates an alarm when an unnamed station transmits 
traffic. By default, the unknown station alarm is disabled. 
There is no threshold setting for this error. 


Generates an alarm when a station sends a frame that 
exceeds 4,608 bytes for 4 Mbps and 18,432 bytes for 16 
Mbps. There is no threshold setting for this error. 


Defines the number of broadcast frames (1 to 65,535) that 
triggers an alarm. You can set the time interval to which 
this threshold applies (5 seconds to 60 minutes). By 
default, the number of broadcast frames is 100 and the 
interval is 5 seconds. 


Defines the length of time (5 seconds to 60 minutes) the 
network can be inactive before generating an alarm. By 
default, the length of time is 15 minutes. 


Defines the percentage (1 to 100%) of absolute network 
usage that triggers an alarm. You can set the time interval 
to which this threshold applies (5 seconds to 60 minutes). 
By default, the percentage is 50 and the interval is 5 
seconds. 


Defines the number (1 to 65,535) of soft error report 
frames that triggers an alarm. You can set the time 
interval to which this threshold applies (5 seconds to 60 
minutes). By default, the number of errors is 20 and the 
interval is 30 seconds. 


Defines the length of time (5 seconds to 60 minutes) the 
ring can beacon before generating an alarm. By default, 
the length of time is 30 seconds. 


Generates an alarm if there is a ring poll failure. There is 
no threshold setting for this error. 
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Station test 

Monitor filters x Unknown station 
History / Oversized frame 
Display Edit #7 / Broadcast storm 
a eo / Network idle 

epor atlon defaults / Network usage 
Manage stations / Soft error reports 
Options Auto clear = Off <¢ | / Ring beaconing 
Exit / Active Poll fail 
Log to 


Specify alarm thresholds for the network as a whole. 


se the arrow keys to move around in the menu 


10 New 
monitor 


Figure 5-2. Global alarms. 


Alarms for Which You Cannot Set Thresholds 


You cannot set thresholds for the “Unknown station,” “Oversized frame,” and 
“Active Poll fail” global errors. Figure 5-3 describes how these alarms are 
represented in the Alarm Log view. When you display the view, you will see the 
actual station name or address under the headings “Alarm Type/Description” 
and “Source.” 


Alarm Type/Description | Source Cause of the Alarm 


1 or more oversized frame. Station that sent the oversized | A station sent a frame that exceeds 
4,608 bytes on a 4 Mb/s network or 
18,432 bytes on a 16 Mb/s network. 


A station sent a Beacon frame, after 
detecting a hard error that renders the 
network inoperable. The station in the 
alarm description is the upstream 
neighbor of the station that sent the 
Beacon frame. 


Station that sent the Beacon 
frame. 


Beacon at station. 


Poll Fail at station. Active Monitor The active monitor sent a Ring Poll 
Failure frame after an error occurred 
during a ring poll process. The station 
in the alarm description is the last 
station that sent an Active Monitor 

| Present or Standby Monitor Present 


frame for the failed ring poll. 


Figure 5-3. Types of alarms for which you cannot set thresholds. 
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Station Alarm Threshold Options 


Station Alarm Threshold Options 


For each station, you can determine the default alarm thresholds for these 


parameters: 


Errors 


No response 


Idle 


Usage 


Priority 


Defines the number of soft error reports (1 to 65,535) a 
station can transmit before triggering an alarm. The 
default is 100. 


Defines how long a station can be sent frames without 
responding before triggering an alarm. To turn the alarm 
off, choose 0 (the default). The possible value can range 
from 1 to 7 seconds. For further information on when the 
monitor generates a no-response alarm, refer to the 
section “Alarm” on page 9-27. 


Defines the length of time (1 to 120 minutes) a station can 
be inactive (not transmitting) before triggering an alarm. 
To turn the alarm off, choose 0 (the default). 


Defines the percentage of relative network traffic (1 to 
100%) the station can transmit before triggering an alarm. 
The default is off. 


Defines the priority level of station alarms. The default is 
Warning. 


Interpreting Alarms When Using Monitor Filters 


When you are interpreting alarms, remember that the setting of the Monitor 
filters option affects alarm generation in the following ways: 


¢ If Monitor filters is set to MAC frames or All frames, the monitor does 
not generate an idle alarm for a station as long as its network interface 
card transmits MAC frames. That is, you are not notified if a station has 
failed to transmit LLC frames. 


¢ If Monitor filters is set to one station, the monitor monitors only the 
frames that contain this station’s address. As a result, the monitor 
considers only this station and its partners active. It generates idle 
alarms for any stations that are not communicating with the monitored 
station, regardless of whether they have been transmitting frames on 


the network. 


Strategies for Setting Alarm Thresholds 


- 


This section provides some basic strategies for setting thresholds. However, 
finding the thresholds that best suit your particular network and preferences 
requires adjustments as you go along and as your network grows. 


Changing alarm thresholds during a monitoring session can lead to unexpected 
results. For example, if you change a threshold that has already triggered an 
alarm, no new alarm is triggered when the new threshold is reached. Therefore, 
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it is best to make any changes before you start monitoring. You can also stop 
monitoring, make changes, and restart monitoring. 


Strategies for Setting Global Alarm Thresholds 
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To get started, follow these steps: 


\ 


Move to the History option in the Main Menu. 


Select the broadcast address as the station for which the monitor collects 
history statistics. 


Set the Intrvl option to 15 minutes. 


Monitor traffic over a period of time, such as an 8-hour business day. 
This gives you an overview of your network’s traffic patterns. 


The following is a list of suggestions for setting various global thresholds and 
handling alarms: 


Network usage and soft error reports thresholds 


Display the Global History view and note the highest number of errors 
and usage percentage. Then set each threshold of these categories to 
about 50% higher than the highest recorded number. 


Broadcast storm threshold 


Display the Station History view and note the highest number of frames 
sent to the Broadcast station. Then set the threshold to about 50% 
higher. 


Network idle threshold 


Take into consideration the way your network software operates. For 
example, if your software package automatically transmits traffic every 
five minutes, setting the idle threshold to six minutes alerts you to any 
problems within one minute. 


Unknown station alarms 


To avoid triggering the unknown station alarm for legitimate stations, 
be sure to name all known stations. This alarm then alerts you to any 
intruders or new stations. Since faulty bridges or bad network interface 
cards usually generate numerous unknown station alarms, this is also a 
good way to detect problems with bridges and cards. 


Be prepared to adjust the thresholds to higher values if you get too many 
alarms. If the alarms that are generated do not alert you to potential problems 
quickly enough, adjust the thresholds to lower values. 


To change the global alarm thresholds: 


ie 


Move to the Alarm \Global alarms menu, which lists the global alarm 
settings as shown in Figure 54. 


Select the global alarm you want the monitor to generate by moving to 
the alarm and pressing the Spacebar. An x preceding the alarm indicates 
that the alarm is disabled; a V indicates that an alarm is generated. 
Pressing the Spacebar toggles the value of this option. 


Strategies for Setting Alarm Thresholds 


Move to the next options list and specify an appropriate priority and 
threshold for the alarm. Press Enter to display a dialog box or a list of 
values. Type or select a value, and press Enter again. 


Repeat steps 2 and 3 for each alarm. 


x Unknown station 
/ Oversized frame 
/ Broadcast storm 
/ Network idle 
Edit / Network usage 
Priority = Criticad 
Errors = 29 4 
Interval = 20:38 d 


Global alarms ‘Moott error reports 
ation aeraults Y King beaconing 


/ Active Poll fail 
Auto clear = 1:00d¢ 


Log to 


Generate an alarm if too many soft error frames are transmitted? 


=Press space to select (/) or not select (x); Alt-space inverts all 


1 
Help 


10 New 
monitor 


Figure 5-4. Threshold options for global alarms. 


Strategies for Setting Station Alarm Thresholds 


When setting alarm thresholds for individual stations, pay particular attention 
to devices that handle a lot of traffic, such as file servers and gateways. Since 
these devices are so important to the entire network, it is important to adjust 
their thresholds so that you are alerted to potential problems quickly without 
getting unnecessary alarms. Also, assign priority levels to individual stations 
according to the stations’ importance. 


The following is a list of suggestions for setting various station alarm 
thresholds: 


Errors threshold 


Monitor the network for approximately 24 hours. Then generate the 
ERRORS report. (For further information on generating reports, refer to 
Chapter 6, “Creating Reports.”) Obtain the highest error count from the 
report and increase it by 50%. Use this number as the errors threshold. 
However, you should adjust this value according to the length of a 
normal monitoring session. For example, if you restart a monitoring 
session every two days, set the threshold to twice the value calculated 
above. Also, if you think the error counts in the ERRORS report are 
abnormally high, you should solve the problems that caused the errors 
before determining the errors threshold. 
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¢ Idle threshold 


For devices such as file servers, set the idle threshold as low as I minute 
to alert you quickly to potential problems. For stations that are likely to 
be turned on and off periodically, set the idle threshold to “Off.” 


¢ Usage threshold 


To identify any stations that use large portions of the network’s 
resources, set a low usage threshold for individual stations. Use this 
information to redistribute heavy users onto different network 
segments to prevent degradation of service to other users. 


As with the global alarm thresholds, be prepared to make adjustments. 


KA To change the station alarm thresholds and priority level: 
LY 1. Move to the Edit option in the Alarm menu and press Enter. The Manage 


Station Information view appears. 


2. Move to the station whose settings you want to change and press Enter. 
A dialog box appears with a list of fields you can edit. 


3. Move to the desired field and press Enter to display an additional dialog 
box. Select or type a value and press Enter. For example, in Figure 5-5, a 
list showing the possible errors threshold settings is displayed. Repeat 
this step until you finish modifying the threshold settings. 
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Figure 5-5. Threshold settings for the station errors alarm. 


4. Move to Priority = in the dialog box and press Enter. A window titled 
“Station Priority” opens. Move to the desired priority level and press 
Enter. 


5. Press Esc to return to the Manage Station Information view. 
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Changing the Default Station Alarm Thresholds 


When the monitor detects new stations on the network, it assigns the default 
alarm thresholds to the stations as it adds them to the station list. If you change 
these default settings, any stations added to the network are assigned the new 
defaults. If you assign names to these stations, the threshold information, 
together with the station addresses, is saved in STARTUP.TRA. 


KA To change the station default alarm thresholds and priority level: 
QY 1. Move to the Alarms \ Station defaults menu, which lists the default 


station thresholds as shown in Figure 5-6. 


2. Move to the threshold setting or priority level you want to change and 
press Enter. A dialog box or a list of values appears. Type in or select a 
value, and press Enter. 


Station test 
Monitor filters 
History 


Displa 4 
Rare Global alarms 
epor Errors = 108 <! 


Manage stations No response = Off ¢ 
Options Auto clear = Off 4 Idle = Off < 
Exit 4 Usage = Off 4 

Log to Priority = Warningd 


Specify the default alarm thresholds for individual stations. 


se the arrow keys to move around in the menu 


ONE 
neyen a me)e 


Figure 5—6. Station default alarm thresholds. 


Resetting Station Alarm Thresholds to Default Values 


After you changed the station alarm thresholds for a monitoring session, you 
can easily restore the default thresholds, either for a single station or for all 
stations. Be sure to stop monitoring before resetting alarm thresholds. 


To reset the alarm thresholds to defaults for a single station: 


1. Move to Edit in the Alarm menu and press Enter. The Manage Station 
Information view appears. 


2. Move to the station you want to reset and press F2 (Apply default). The 
threshold settings for that station change to the default values. 
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® 


To reset the alarm thresholds to defaults for all stations: 


1. Move to the Reset thresholds option in the Manage stations menu and 
press Enter. The monitor displays this message: 


Any changes made to station alarm configurations will be lost if you 
proceed. Press ENTER to proceed. Press ESC to cancel. 


2. Press Enter. The monitor displays this message: 
Resetting alarm thresholds. | 


Displaying the Alarm Log 


® 


The Alarm Log view displays the contents of the alarm buffer. It lists alarms in 
the order they occurred and shows their priority, the time they occurred, the 
source of the alarm, and the type of alarm. 


Once the Alarm Log view is displayed, you can acknowledge alarms or clear 
them from the alarm buffer. 


To display the Alarm Log view: 
1. Move to Alarm log in the Display menu and press the Spacebar. 
2. Press F3 (Display) or press Enter to display the Alarm Log view. 


Acknowledging Alarms 


oO 


Y 


Sy 


Clearing Alarms 
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To keep track of which alarms have been investigated, you can mark 
(acknowledge) those alarms in the monitor’s Alarm Log view. It is, however, 
recommended that you acknowledge alarms in the alarm log. 


Acknowledging an alarm in the monitor's alarm log affects the level of the 
audible alarm. Suppose the monitor’s alarm log contains two alarms, one with 
priority level Critical and the other Major. Before the critical alarm is 
acknowledged, the audible alarm level is Critical. After you acknowledge the 
critical alarm, the alarm level changes to Major. 


To acknowledge an alarm: 
1. Display the Alarm Log view. 


2. Move to the alarm you want to acknowledge and press F3 (Ack alarm). 


A V mark appears in the right column to indicate that you have 
acknowledged the alarm. 


The alarm buffer can contain up to 200 alarms. When the buffer is full, new 
alarms are deferred until you clear some of the existing alarms in the buffer. 
However, a deferred alarm is lost when the condition that caused it no longer 
exists. In this case, there is no record that the deferred alarm occurred because 


Clearing Alarms 


alarms are printed or saved to disk only as they are placed in the monitor’s 
alarm buffer. 


Effects of Clearing Alarms 


Whether an alarm will recur after you clear it depends on the alarm type, as 
described below: 


Soft error reports, network usage, broadcast storm, ring beaconing, or 
active poll fail alarm: 


An alarm is triggered only the first time the threshold is exceeded. 
Additional instances of this event are ignored unless you clear the 


alarm. That is, if the threshold is exceeded again after the clearing, the 


monitor generates a new alarm. 


Network idle, station idle, station usage, or station no response alarm: 


An alarm is triggered only the first time the threshold is exceeded. 
Additional instances of this event are ignored unless the alarm has been 
cleared and the condition that caused the alarm has been removed. For 
example, a station alarm is generated because a station has been idle for 
15 minutes. If it continues to be idle after you clear the alarm, no new 
alarms are generated. However, if the station transmits at least once 
and then becomes inactive again for more than 15 minutes, the monitor 
will generate a new alarm for this station. 


Unknown station or station errors alarm: 


Even if the alarm is cleared from the buffer, the same condition does not 
cause an alarm to appear in the alarm log. 


Different Ways to Clear Alarms 


Clear alarms only when the monitor is running in the foreground. You can clear 
alarms in one of two ways: 


Manually clear alarms one at a time. Clear the alarms as soon as you 
deal with them. 


Use the Auto clear option. The monitor automatically clears each alarm 
after it is in the buffer for a specified period of time. This method is 
recommended because it slows down the speed at which the alarms 
approach the 200-alarm limit. 


When you use Auto clear, you should also enable the Log to option, 
which automatically prints or saves to disk a record of alarms generated 
while the network is unattended. By default, Auto clear is set to 1 hour, 
and the alarms are logged to disk. If you are concerned that the alarms 
occupy too much disk space, disable the File option in the Alarm \Log 
to menu or remove the alarm log file regularly. The logging function is 
described in the section, “Using the Monitor’s Logging Function.” 


When you start a new monitoring session, the monitor automatically removes 
all the alarms in the alarm buffer that were generated in the last session. 
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KIS To clear individual alarms manually: 
ey 1. Display the Alarm Log view. 
2. Press F3 (Display) or press Enter to display the alarm log. 


3. Move to the alarm you want to clear and press F4 (Clear alarm). The 
alarm is cleared from the alarm buffer. 


&) To clear alarms automatically: 
1. Move to Alarm in the Main Menu. 


2. Move to Auto clear = and press Enter. 


3. In the dialog box, type a value between 1 minute and 99 hours and press 
Enter. 


Using the Monitor’s Logging Function 


The monitor’s logging function automatically prints and saves alarms as they 
are sent to the alarm buffer. This assures that there is a record of alarms, even 
after they are cleared from the buffer and the Alarm Log view. By default, the 
monitor saves alarms to the disk. 


Printing Alarms 


You can save the alarms for each monitoring session to disk and print them as 
necessary. Alternatively, you can print each alarm on a designated printer as it 


occurs. 
KA To print alarms automatically: 
Vy) 


1. Move to the Alarm \Log to menu. 


2. Make sure a V mark appears to the left of the Printer option. If not, press 
the Spacebar to display the V mark. 


3. Move to the Alarm \Log to\Printer menu, which includes six ports 
(COM1, COM2, LPT1, LPT2, LPT3, and LPT4 ). Move to the desired 
printer port and press the Spacebar. 


4. Tospecify the number of lines per page, move to Page size = in the 
Alarm \Log to\Printer menu and press Enter. A dialog box appears. 


5. Type the number of lines to be printed on a page and press Enter. The 
number can range from 1 to 256. The default is 58. 


If the number you specify is greater than the number of lines that fit on a page, 


the printing overlaps the page breaks, which might make the hard copy difficult 
to read. 


Saving Alarms to Disk 


In addition to, or instead of, printing alarms as they occur, you can save them to 
the file ALARM.LOG in the C:\TRALARMS directory. You can either append 
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the alarms to those saved during previous sessions or reinitialize the file each 
time the monitor starts monitoring. 


It is recommended that you save only the alarms from the current session and 
deal with alarms as they happen. Use the append option only for collecting 
historical information about alarms. Otherwise, the ALARM.LOG file 
eventually becomes huge. 


KZ To save alarms automatically: 
wy 

1. Move to the Alarm\Log to menu. 

2. Move to the File option. 

3. Ifnecessary, press the Spacebar to make sure a V mark appears to the left 
of the File option. 

4. Move to Clear alarm file in the Alarm \ Log to \File menu. To append the 
current alarms to existing alarms from previous monitoring sessions, 
press the Spacebar to display the x mark to the left of the option. To 
overwrite previous alarms, press the Spacebar to display a V mark. 

The monitor saves the current alarms in ALARM.LOG in the 
C:\TRALARMS directory. 
& To view ALARM.LOG: 
1. Select the Exit option in the Main Menu and press Enter. The Monitor 


Selection Menu appears. 


2. Select the Exit to the Operating System option. When the DOS prompt 
appears, use the DOS command, TYPE, to view the ALARM.LOG file. 


To return to the Monitor Service Menu after viewing the file, type MENU 
at the DOS prompt and press Enter. 


= The ALARM.LOG file is not updated while you are viewing it in DOS (or at any 
Se other time the monitor application is not running in the foreground). 


Setting Audible Alarm Thresholds 


You can specify the level of unacknowledged alarms that generate audible 
alarms. There are five different audible alarms that can be generated, one for 
each level of alarm (Inform, Warning, Minor, Major, and Critical). Each level of 
alarm generates a specific audible alarm at a different pitch. The more severe the 
alarm, the higher the pitch. The five audible alarms are: 


¢ Inform — one beep 

* Warning — two beeps 
* Minor — three beeps 

* Major — four beeps 

¢ Critical — five beeps 


Audible alarms are generated when the Token-Ring Monitor is running in the 
foreground as well as in the background. 
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KD To set the audible alarms: 
Ky 1. Move to Options in the Main Menu. 


2. Move to Audible Alarms (see Figure 5-7) and press the space bar to turn 
the audible alarms on or off. 


3. Move to the desired alarm level and press the space bar to select the 
alarm level. You can select any combination of alarm level. 


oret 

Monitor filters 

History 

Display 

Alarm 

Report 

Manage stations 

Options X / Inform 

Exit / Warning 
4 Mb/s / Minor 
16 Mb/s / Major 

/ Critical 


Should alarms cause an audible warning? 


Press space to select (/) or not select (x); Alt-space inverts all 


1 | 18 New 
Help monitor 


Figure 5-7. Audible Alarms. 
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General 


Creating Reports 


Overview 


In addition to viewing network statistics, you can create customized reports 
that show these statistics in any combination, sorted and arranged according to 
your preferences. You can use these reports to document your network 
activities, justify the need for hardware upgrades, compare network 
performance over time, and so on. 


This chapter provides an overview of the sample report scripts shipped with the 
monitor and describes the following tasks: 


¢ Loading a report script 
¢ Previewing a report 


¢ Printing or saving a report to disk, in either normal or CSV (comma- 
separated values) file format 


¢ Creating or editing a report script 


Sample Reports: An Overview 


The monitor comes with report scripts you can use or modify. A report script is 
a template that defines which statistics are included in the report and how these 
statistics are arranged on the screen or page. When you generate a report from 
a report script, the monitor supplies the statistics, inserts them into the report 
script, and then prints or saves the report to disk. 


You can use the same report script over and over. The types of statistics and the 
format of the report remain constant; only the statistics change each time you 
print a report. 


When you use the monitor for the first time, the only report scripts you can use 
are the sample report scripts shipped with the product, which are described 

later in this chapter. If none of these report scripts suits your needs, create anew 
report script or edit an existing script. Then save this new report script for future 
reports. You must name and save this newly created script before you can use it. 


These are the script files stored in the directory C:\TRREPORT \SCRIPTS: 
¢ ERRORS.SCR 
¢ FRAMSIZE.SCR 
¢ HISTORY.SCR 
¢ LISTENRS.SCR 
¢ RINGORDR.SCR 
¢ ROUTELEN.SCR 
¢ ROUTEPTH.SCR 


ie 
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¢ SAPS.SCR 
¢ TALKERS.SCR 
¢ USERLIST.SCR 
* USERS.SCR 

* USERSCSV.SCR 


ERRORS.SCR 


The report based on ERRORS.SCR shows the 10 stations that transmitted the 
most soft error report frames. The stations are sorted in descending order by the 
number of errors. Only the stations that have sent at least 5 soft error report 
frames are included. 


Figure 6-1 is an example of a report based on ERRORS.SCR. 


Top 1@ Errors 


This report provides statistics for the 18 stations which have 
transmitted the most soft error report frames. Stations must have 
transmitted at least 5 soft error report frames to be included in 
this report. 


Monitoring Started: Oct 04 99:52:32 Total Stations: 26 
Monitoring Stopped: Oct 04 09:56:93 
Elapsed Time: Q day(s) 00:83:31 


Name Frames Errs Bytes Size % Abs 


1 Print Server 8,838 13 627, 706 71 0.59 
2 File Server 12,844 19 1,685,407 131 1.59 
3 William Griffith 843 6 472,134 560 9.44 


Hit Esc to quit, any key to continue 


Figure 6-1. Errors report. 


The report shows the following types of statistics: 
¢ Time monitoring started 
¢ Time monitoring stopped 
¢ Duration of the monitoring session (elapsed time) 


¢ Total number of stations 


Information displayed for each station includes: 
* Sort position 


¢ Station’s name 


ii 
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* Number of frames from the station 

¢ Number of soft error report frames from the station 
* Number of bytes from the station 

¢ Average size of the frames from the station 


¢ Percentage of absolute network usage by the traffic from the station 


FRAMSIZE.SCR 


The report based on FRAMSIZE.SCR shows the frame size distribution. It 
includes the frame size categories, the number of frames per category, and the 
percentage per category. The report also contains a graph that illustrates the 
percentages. The report contains the same information and has the same format 
as the display generated when you select Frame sizes in the Display menu. 
Figure 6-2 is an example of a report based on FRAMSIZE.SCR. 


Frame Sizes 


This report supplies frame size distribution information. 


Size Frames Percent g 20 40 66 86 


Under 17 i) 0.06 
7 g i) 

18- 15,278 26.21 
33- 12,028 28.63 
65- 21.22 
129- 14.96 
257- 5.91 
513- 1024 2.45 
1025- 2048 5.84 
2049- 4696 2.15 
4097- 4628 6.00 
Over 4608 . 0.00 


Hit Esc to quit, any key to continue 


Figure 6-2. Frame sizes report. 
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HISTORY.SCR 


The report based on HISTORY.SCR shows absolute network usage during each 
history interval. This report includes a graph with a scale of 10% to illustrate the 
network usage percentages. Figure 6-3 is an example of a report based on 
HISTORY.SCR. 


History 


This report provides traffic history information. 


Time Usage @ 


44 Oct 18 16:19:28 11.63 
16:18:28 7.81 
16:17:28 9.88 
16:16:28 3.25 
16:15:28 5.93 
16:14:28 7.44 
16:13:88 7.83 
16:12:28 8.88 
16:11:88 13.74 
16:18:28 5.27 
16:89:28 6.45 


_— 
Rm BDO GO BR OTTO ™] CO WO & 


Hit Esc to quit, any key to continue 


Figure 6-3. History report. 
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Sample Reports: An Overview 


The report based on LISTENRS.SCR shows statistics for the 10 stations that 
received the most traffic during the most recent monitoring session. 


Stations are sorted in descending order by the number of bytes received and 
filtered by sort position to display the 10 stations that received and transmitted 
the most bytes. 
The report shows the following types of overall information: 

¢ Time monitoring started 

¢ Time monitoring stopped 


¢ Duration of the monitoring session (elapsed time) 


Information shown for each station includes: 
* Sort position 
¢ Station's name 
* Number of frames to the station 
* Number of bytes to the station 
* Average size of the frames to the station 


* Percentage of relative network usage by the frames to the station 


Figure 6—4 is an example of a report based on LISTENRS.SCR. | 


Top 1@ Listeners 


This report provides statistics for the 1@ stations which have 
received the most traffic. The stations are sorted by bytes 
received. 


Monitoring Started: Oct 29 14:38:01 
Monitoring Stopped: Oct 29 14:38:12 
Elapsed Time: OB day(s) 00:00:11 


Frames Bytes Size % Rel 
File Server 335 39.49 
Print Server , 449 35.18 
Mark Ellison , 547 Ss «45,19 
Tom Brown 193 1.88 
Ken Quinn 253. «1.77 
Miles Russell 142 1.65 
David Brooks 155 1.59 
Wes Harding 144 1.45 
Ed Hicks 131 1.41 


1 
2 
3 
4 
) 
6 
7 
8 
9 


Hit Esc to quit, any key to continue 


Figure 6-4. Listeners report. 
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RINGORDR.SCR 


The report based on RINGORDR.SCR shows the relative usage information for 
all stations. The stations are sorted by the ring order in descending order. The 
active monitor is displayed first, followed by the standby monitors. Other 
stations are arranged according to the station status in this order: snooper, 
removed, remote, inactive, and group. For information on station statuses, refer 
to Chapter 9, “The Monitor Menu Items.” 


The report shows the following types of statistics for each station: 
* Sort position 
¢ Station status 


¢ Percentage of relative network usage by the frames from the station 


The graph in the report illustrates the percentages. The scale of the graph is 
100%. Figure 6-5 is an example of a report based on RINGORDR.SCR. 


User Ring Order 


This report provides relative usage information for all users. The 
users are sorted by ring order. 


Name Status ¥Rel B 20 46 60 89 


File Server Active Mon 14.95 
Bill Goodman Standby Mon 1.42 
Mark Ellison standby Mon 8.25 
William Griffith Standby Mon 4.95 
Print Server Standby Mon 5.98 
Michael Harley Standby Mon 3.45 
Anthony Serrao Standby Mon 9.39 
James Wylie Standby Mon 9.47 
Fred Biddle Standby Mon 9.71 
Tom Brown Standby Mon 3.66 
Robert Hayes Standby Mon 9.82 
Miles Russell Standby Mon 1.39 
Steven Anderson Standby Mon 8.67 


Hit Esc to quit, any key to continue 


Figure 6-5. Ring order report. 
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Sample Reports: An Overview 


The report based on ROUTELEN.SCR shows the route length distribution 
information. It shows the number of frames that have different route lengths 
and indicates the percentages of these frames. The graph illustrates the 
percentages. Figure 6-6 is an example of a report based on ROUTELEN.SCR. 


Route Lengths 
This report supplies route length distribution information. 


Frames Percent @ 20 46 62 80 


g 8.20 
22,186 
26,388 
4,949 


g 
4 
2 
3 
4 
5 
6 
7 
8 
9 


AQRVQRWOARWRRhWwRwW 


Over 12 


Hit Esc to quit, any key to continue 


Figure 6-6. Route lengths report. 
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ROUTEPTH 
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The report based on ROUTEPTH.SCR shows the route path distribution 
information. It shows the number of frames moving between the local and 
remote networks. Figure 6-7 is an example of a report based on 
ROUTEPTH.SCR. 


Route Paths 


This report supplies route path distribution information. 


Path Frames Percent @ 20 46 68 88 


Loc-Loc 216,343 77.77 
Loc-Rem 29,929 10.75 
Rem-Loc 24,195 8.69 
Rem-Rem 5, 787 2.25 
Loc-Other 1,991 Q.71 
Rem-Other g B20 


Hit Esc to quit, any key to continue 


Figure 6-7. Route paths report. 


Sample Reports: An Overview 


SAPS.SCR 


The report based on SAPS.SCR shows the SAP protocol type distribution 
information. It includes a list of SAP protocols, the number of bytes per SAP 
protocol type, and the percentage of each protocol type. The graph illustrates 
the percentages. Figure 6-8 is an example of a report based on SAPS.SCR. 


SAP Protocols 


This report supplies SAP protocol type distribution information. 


Bytes %Total @ 20 40 6 82 


9,642,637 13.21 
4,958, 226 6.79 
23,268,856 31.89 
748, 851 1.82 
15,449,798 21.18 
4,950,555 6.78 
Bg B20 

283, 182 8.38 
498,918 0.67 
392,182 §.53 
471,125 B23 
9,248, 884 7,19 


| Hit Esc to quit, any key to continue 


Figure 6-8. SAP protocols report. 
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TALKERS.SCR 


The report based on TALKER.SCR shows statistics for the 10 stations that 
transmitted the most traffic during the most recent monitoring session. 


Stations are sorted in descending order by the number of bytes transmitted and 
filtered by sort position. The report includes the 10 stations that transmitted 
most traffic. ' 


Figure 6-9 is an example of a report based on TALKERS.SCR. 


Top 18 Talkers 


This report provides statistics for the 19 stations which have 
transmitted the most traffic. The stations are sorted by bytes 
transmitted. 


Monitoring Started: Oct 84 09:52:32 Total Stations: 26 
Monitoring Stopped: Oct 84 10:19:17 
Elapsed Time: ® day(s) 08:26:45 


Report Generated: Oct 04 10:19:17 


Bytes Errors Size % Rel 


Denise Martin 11,198,778 1748 14. 46 
File Server 11,127,643 32 126 14.38 
Ed Hicks 9,177,893 2 1477 11.86 
Linus Stanwick 8,549,913 1362 11.05 
Mark Ellison 7,455, 412 1138 9.63 
Steven Anderson 6,183,827 12 975 7.89 
Print Server 4,351,201 38 72 5.62 


Hit Esc to quit, any key to continue 


Figure 6-9. Talkers report. 


The report shows the following general information: 
¢ Time monitoring started 
¢ Time monitoring stopped 
¢ Duration of the monitoring session (elapsed time) 
¢ Total number of stations | 


¢ Time when the report was generated 


Statistics shown for each station include: 
¢ Sort position 
¢ Station’s name 
¢ Number of bytes from the station 
¢ Number of soft error report frames from the station 
¢ Average size of the frames from the station 


¢ Percentage of relative network usage by the frames from the station 
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USERLIST.SCR 


The report based on USERLIST.SCR lists the physical addresses and names of 
all stations that are in the station list, sorted by address in ascending order. No 
filters are used to limit the number of stations. This report is useful for you to 
view the names assigned to addresses. You can use it to set up the monitor 
station data file, STARTUP.TRD. Figure 6-10 is an example of a report based on 


USERLIST.SCR. 


Station List 


This report lists the physical address and assigned name of each station. 
The stations are sorted by address. 


SACORO4EORE5 
PPCROL4E O12 
O2ORBC4E 2062 
OPO0B04E 0100 
G260004EB257 
0200004E0323 
O000004E033E 
QOGORB4EV652 
QQ02004E0654 
OA000B4E2001 
PQORO04E2108 
QA00004E2301 
OPOOBB4E2304 
9200204E3296 
0200004E3106 


George Stanley 
Linus Stanwick 
Helene Milici 
Print Server 
Wes Harding 
Anthony Serrao 
Robert Hayes 
Alex Zwick 

Ken Quinn 
Denise Martin 
Ed Hicks 

Jill Franz 

Tom Brown 
Michael Harley 
Barney Ingram 


Hit Esc to quit, any key to continue 


Figure 6-10. User list report. 
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USERS.SCR 


The report based on USER.SCR shows transmission and reception statistics for 
all stations, sorted in ascending order (alphabetically) by name. No filters are 
used to limit the number of stations. 


The report shows the following types of statistics: 
¢ Time monitoring started 
¢ Time monitoring stopped 


¢ Duration of the monitoring session (elapsed time) 


Statistics shown for each station include: 
¢ Sort position 
¢ Station's name 
¢ Number of frames from and to the station 
¢ Number of soft error report frames to and from the station 
¢ Number of bytes from and to the station 
¢ Average size of frames from and to the station 


¢ Percentage of relative network usage by the frames from and to the 
station 


Figure 6-11 is an example of a report based on USERS.SCR. 


All Users 


This report provides combined transmit and receive statistics for all 
stations. The stations are sorted by name. 


Monitoring Started: Oct @4 99:52:32 


Monitoring Stopped: Oct @4 18:28:52 
Elapsed Time: Q day(s) 00:36:20 


Frames [rrs Bytes Size % Rel 


Alex Zwick 1,622,561 1.69 


Anthony Serrao 779, 284 O81 
Barbara Lemmon 2,157,874 2.25 
Barney Ingram 1,798,932 1.86 
Bill Goodman 1,988, 423 2.07 
David Brooks 1,122,354 1.17 
Denise Martin ; 14,538,327 926 15.17 
Ed Hicks 12,076,394 782 12.60 
File Server 59,133,879 267 61.72 
Fred Biddle 1,022,437 63 1.26 


Hit Esc to quit, any key to continue 


Figure 6-11. Users report. 
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Report File Format 


The report based on USERSCSV.SCR shows the same information as the USERS 
report, but in a comma-separated-values (CSV) format that allows you to 
import the information into spreadsheets, databases, or other applications that 
use the CSV format. The CSV format is also called “delimited format.” Refer to 
“Report File Format” on page 6-15 for more information on definitions of 
different formats. 


Figure 6-12 is an example of a report based on the USERSCSV script. 


"Name", "Frames", "Errs", "Bytes", "Size", "% Rel" 
"Active Mon. a 6, , 
"All Bridges . 
"All Fs Broadcast”, 
“Broadcast ae 
"Config Srv 

"Error Mon. 

"IBM  78268C 

"IBM 782893 

"IBM 782BB7 

"IBM 781EBA 

"IBM 78241) 


Hit Esc to quit, any key to continue 


Figure 6-12. Users report (delimited format). 


Report File Format 


Normal Format 


Delimited Format 


A report can be in normal format or delimited format. The only sample report 
script in delimited format is USERCSV.SCR. 


The normal file format is the default format. Numbers that are 1,000 or greater 
are printed with embedded commas (for example, 1,100,000) in normal file 
format. Figure 6-1 is an example of an Errors report in normal file format. 


A report in delimited format contains no page breaks and embedded commas 
within fields. Figure 6-12 is an example of a report in delimited format. 
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> 


The delimited format allows you to import the file into other applications, such 
as spreadsheets and databases. For example, you might want to show the 
comparative usage of your network servers in a pie chart. After creating a report 
that provides those statistics and then importing that report into a spreadsheet 
application program, use the spreadsheet program’s graphics capabilities to 
create a pie chart based on your report. 


To separate the fields from each other, insert a comma between the fields in the 
report script. Also, if a field is a character string (for example, a station name), 
use quotation marks to enclose the character string. 


If the application program into which you want to import data requires 
additional formatting, make these changes in your report script. Refer to the 
application’s documentation for details about required filenames, field formats, 
and other considerations. 


Refer to “Creating or Modifying a Report Script” on page 6-20 for information 
on specifying a report script’s file format. 


Generating a Report 


To generate a report, you must first load into memory the report script that 
specifies the statistics you want to include. When you display, print, or save this 
report, the monitor automatically inserts the statistics from the current 
monitoring session. 


Loading a Report Script 


K2\ 
OY 


Previewing a Report 
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To load a report script: 
1. Move to the Report menu. 


2. Select the Load option and press Enter to display the list of available 
reports, including the sample report scripts and any other report scripts 
that have been saved. 


3. Move to the report you want to load and press Enter. 


You can edit a report script once you load it. In addition, you can do any of the 
following to the report generated by the script: 


¢ Preview it on the screen. 
¢ Print it on a printer. 
« Save it to the disk. 


¢ Clear its contents. 


You can preview a report by printing it to the screen. 


Generating a Report 


&®) To preview a report: 
1. Load the desired report script. 


2. 


Move to Edit in the Report menu and press Enter to display the Report 
Script Editor view, which contains the script you loaded. 


Press F9 (Screen test) to display the report generated by the script. If the 
report consists of more than one screen, press any key to see the next 
screen. To return to the script, press Esc. 


Printing a Report Manually 


You can print the report on a printer you designate. You can also specify the 
number of lines to be printed before the monitor inserts a page break and report 
header if the report is in normal format. Refer to “Report File Format” on page 
6-15 for more information on report formats. 


KZ To print a report manually: 
wy 
1. Load the desired report script. 
2. Move to the Report\Print menu to select the device to which the report 
is printed. You can select among these options: 
* Screen displays the report on the screen. 
* Device COM1 sends the report to port COMI. 
* Device COM2 sends the report to port COM2. 
¢ Device LPT1 sends the report to port LPT1. 
¢ Device LPT2 sends the report to port LPT2. 
¢ Device LPT3 sends the report to port LPT3. 
¢ Device LPT4 sends the report to port LPT4. 
* File saves the report to the disk. (Refer to “Saving a Report to Disk” 
on page 6—19 for more information.) 
3. If Delimited format in the Report\Edit menu is enabled, go to step 4. 


Do you need to change the number of lines per page? 


° Ifyes, move to Page size =, and press Enter. In the dialog box that 
appears, type the desired number of lines, or turn off the option by 
typing 0, then press Enter. 


When the monitor inserts a page break, it also prints the header text 
(for example, the title of the report or a description of the report as 
defined in the report script). If this option is turned off, the monitor 
does not insert any page breaks in the printout. 


If the number of lines you specify exceeds the length of the page, the 
monitor prints the number of lines you specified, overlapping the 
page break. 


° I£fno, go to step 4. 


4. Move to Print in the Report menu and press Enter. 


5. A dialog box appears. Type the filename under which the report is saved. 
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Printing a Report Automatically 


You can specify that the monitor prints out a report regularly. This feature is 
available only if the monitor application is operating in the foreground. 


KZ To print a report automatically: 
SY 
1. Load the report script: 


a. Move to the Report\ Auto print menu. 


b. Select the Report = option and press Enter. A list of report scripts 
appears. 


c. Move to the desired report script and press Enter. 
2. Specify the time when the print interval is to start: 

a. Move to Start time = and press Enter. A dialog box appears. 

b. Do you want to start printing the report immediately? If yes, type 
00:00. If no, specify the time in hh:mm format. Press Enter when you 
finish typing. 

3. Specify how often the report is printed: 
a. Move to Interval = and press Enter. A dialog box appears. 
b. Type the time interval in hh:mm format and press Enter. 
4. To print to disk, go to step 5. 
To print to a printer: 
a. Enable the Print to device option. 


b. Specify the printer port and page size in the Report\ Auto 
print\ Print to device menu. 


c. Goto step 6. 
5. To print to disk: 
a. Enable the Print to disk option. 


b. Move to the Report \ Auto print\ Print to disk menu. To specify that 
the monitor prints each report to a separate file, select Multiple files; 
to specify that the monitor prints all reports on the same day to one 
file, select Single file. 


6. Torestart a monitoring session after a report is printed, move back to the 
Report \ Auto print menu to enable the Restart monitor option. 


For information on how the monitor names the reports generated 
automatically, refer to the section, “Filenames for Automatically Generated 
Reports.” 


Terminating Automatic Report Generation 
When the monitor is printing a report automatically, this message appears: 


Generating automatic report. 
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Generating a Report 


If you want to terminate the automatic report generation, press the Esc key 
while the above message is displayed. The monitor stops printing immediately 
and displays the following message: 


Automatic report generation aborted. 


Subsequent report generation is not affected. For example, if Interval is set to 
1:00 and Restart monitor is enabled, the monitor prints a report every hour and 
starts anew monitoring session after each printing, regardless of whether you 
have aborted automatic report generation. 


Filenames for Automatically Generated Reports 


The monitor names the automatically generated reports according to the file 
creation dates in either of these forms: ARYYMMDD.RPT. and 
YYMMDDNN.FPT. (The extension is CSV if the report is in delimited format. 
Refer to “Report File Format” on page 6-15 for more information on different 
file formats, and “Creating or Modifying a Report Script” on page 6-20 for 
selecting the desired format.) 


For example, if you specify that all reports are automatically printed to a single 
file, a file created on April 28, 1991, is named AR910428.RPT. The monitor 
creates a new file after midnight. In this example, the new file created after 
midnight is named AR910429.RPT. 


If you specify that each report is automatically printed to a separate file, the 
number of the report follows the date. For example, the first report generated 
on April 28, 1991, is named 91042801.RPT, the second report on the same day is 
named 91042802.RPT, and so on. 


Reports generated automatically are stored in the C:\TRREPORT directory. 


Saving a Report to Disk 


You can save a report to preserve the statistics generated during a monitoring 


session. 
KZ To save a report to disk: 
OY 
1. Load the desired report script. 


2. Move to Print, then to File, and press the Spacebar. 


3. Tosave the report in the normal file format, make sure that an x displays 
to the left of the Delimited format option. To save the report in CSV 
format, make sure that a V mark appears to the left of the option. If 
necessary, press the Spacebar to toggle the setting of Delimited format. 


Move back to Print and press Enter to display the dialog box. 


Type a filename without the extension and press Enter. 


The monitor saves the report in the C:\TRREPORT\SCRIPTS directory and 
appends the extension RPT or CSV to its filename, depending on the file format. 
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If existing report scripts do not meet your needs, you can create a new report 
script or modify an existing script. For example, to replace the “Bytes” column 
in the TALKERS report script with “Frames,” simply change the column 
heading and the associated code. You can make any substitutions you wish in 
this way to create customized reports. 


The procedure of editing a report script includes the following tasks: 


¢ Clear the contents of an existing report script in the Report Script Editor 
view if one is loaded. 


e Enter text. 
¢ Define which statistics (fields) to include in the report. 


¢ Define which field to use to sort the report, in either ascending or 
descending order. 


¢ Define one or two filters to further refine the report so that the report 
contains only the stations that you are interested in. 


¢ Define the report format. 


¢ Determine the report's appearance by adding or deleting blank lines, or 
by adding special characters such as horizontal and vertical lines. 


¢ Preview the report. 


* Save and rename the report script for future use. 


To create a blank report script: 
1. Select the Edit option in the Report menu. 
Have you loaded a report script? 
If yes, the script appears. Follow steps 2 through 4 to clear the script. 


If no, a blank report script appears in the Report Script Editor view. Go 
to the next procedure to edit the fields in a report script. 


2. Toclearan existing report script, press F6 (Edit options). The edit options 
appear. 


3. Move to Clear and press Enter. This message appears: 
Clearing report script. 


4, Press F6 (Return) to display a blank report script. 
To edit the fields in a report script: 


The types of statistics in a report depends on what report fields are included in 
the script. The following procedure shows how to edit the fields. The TALKERS 
report script is used as an example. The procedure shows just one way to edit a 
report script. Once a report script displays, you can vary the order in which you 
do various tasks or skip those tasks not relevant to your needs. 


Creating or Modifying a Report Script 


1. To define which statistics to include, position the cursor where you want 
the field to appear. Then press F2 (Insert field) to display the list of 
available fields. The screen shown in Figure 6-13 appears. (For 
definitions of the report fields, refer to Appendix B, “Report Fields.”) 


2. Move to the first field you want to display and press Enter. 


Some of the fields provide several options for you to further customize 
the field. For example, after you select the % Usage field, a window 
appears, which contains Absolute and Relative. These options 
correspond to the absolute and relative percentage of network usage. 
Use the cursor keys to move to the appropriate option and press Enter. 


A code (for example, @ss@) appears on the screen. When the monitor 
compiles the report, it automatically substitutes a value for that code. 


FIELD 
Global Errors Station From To Both 


Stations State Sort Pos Partner Partner Partner 
% Usage Oversize Address % Usage % Usage % Usage 
Frames Purges Name Frames Frames Frames 
SoftErrs Status Errors Errors 
Hist Stn Bytes Bytes Bytes 
Text Avg Size Avg Size Avg Size 


CSV Ret First First First 
Last Last Last 
Elapsed Elapsed Elapsed 
History History History 


FrmSizes 
Routing 
SAPs 


Etypes 


Figure 6-13. Report fields that can be inserted into a report script. 


3. Position the cursor where you want the next field to appear. There must 
be at least one space after the previous field. Also, be sure that the end of 
the field does not exceed the end of the line. 


4. Press F2, select the second field you want to display, and press Enter. 
(For the Talkers report, you would select Name under the heading 
Station). 

Repeat steps 2, 3, and 4 until you have defined all the fields. 

5. To enter text, use the cursor keys to move the cursor to the desired place 
and start typing. For example, you might want to enter explanatory text 
or headers for the fields you selected. The upper-right corner identifies 


the cursor position by row and column to help you place the cursor 
precisely. The DEL key deletes the current character. The Ins (Insert) key 
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inserts characters; if you have not pressed Ins, the character you type 
overwrites the current one. 


Figure 6-14 shows the codes for the fields of the TALKERS report and the 
explanatory text. Each report script can contain up to 58 lines. 


When you enter the @ symbol in your report, the monitor displays @@ to 
differentiate your input from the keyboard from the @ symbols used as 
delimiters in the field codes. When you send the report to the printer, the 
report correctly prints the @ sign you typed. 


-REPORT SCRIPT EDITOR--——————_TALKERS . SCR 


Top 19 Talkers 


This report provides statistics for the 18 stations which have 
transmitted the most traffic. The stations are sorted by bytes 
transmitted . 


Monitoring Started: | @GMON START...e Total Stations:  eGSe 
Monitoring Stopped: 
Elapsed Time: @ 


Report Generated: @GCURRENT TIMEe 


Bytes Errors Size % Rel 
eFERe eFAYe  eFUREe 


Figure 6-14. Talkers report script. 


To sort and filter statistics in a report: 


1. 


When the Report Script Editor view is displayed, press F6 (Edit options). 
A list of edit options appears. 


Move to Report settings, and then to Sort by to display the sort options. 
A display as shown in Figure 6-15 appears. 


Follow these steps to specify how the statistics are sorted: 


a. Move to and select the To, From, or Both option by pressing the 
Spacebar. This option is applicable if the sort key (to be selected in 
step c) is related to the traffic direction. For example, if the sort key 
is Frames, the To, From, or Both option determines whether frames 
sent to, received by, or both, are used as the sort key. If the sort key 
is Name, this option does not affect how the stations are sorted. 


For the TALKERS report, select the From option to sort the stations 
according to the amount of traffic from the stations. 


b. Move toand select either Ascending or Descending to select the sort 
order. 


C. 


Creating or Modifying a Report Script 


For the TALKERS report, select the Descending option. 
Move into the list of sort keys and press the Spacebar. 


For the TALKERS report, select Bytes. 


By selecting these options, the Talkers report displays the stations that 
transmit the most bytes in descending order. 


-REPORT SCRIPT EDITOR—-———————TALKERS . SCR 


From 
Both 


Ascending 
Descending 


Load 

Report settings Name 

Save Partner's name 
Clear x Active stns only Ring order 
Print x Inserted stns only Frames 

Auto print Errors 


x Delimited format Bytes 
Average size 


ore! ore! 
Select the field by which the stations will be sorted. 


Use the arrow keys to move around in the men 


5 6 
Menus Return 


Figure 6-15. Options for sorting statistics in a report. 


3. 


Choose the type of station to be included in the report: 


a. 


To include only the stations that have sent or received frames, select 
the Active stn only option for Report settings. A V mark preceding 
the option indicates that it is selected. An x mark indicates that it is 
not selected. If the option is not selected, every station, regardless of 
whether it has received or sent traffic, is included. 


To include only the inserted station, select Inserted stns only. A V 
mark preceding the option indicates that it is selected. An x mark 
indicates that it is not selected. A station whose station status is 
active monitor, standby monitor, or snooper is considered an 
inserted station. 


Select filters to limit the stations to be displayed in the report. Follow 
either of these steps to choose the filter, depending on the number of 
filters you need: 


To use one filter, move to Filter 1. If necessary, press the Spacebar to 
display the V mark. Then move to Filter 2. If necessary, press the 
Spacebar to display the x mark to disable the second filter. 


If you want to use a second filter, decide whether you want the 
statistics to pass either filter or both filters, and select the appropriate 
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operator option (OR or AND). Then move to Filter 2 and make sure 
it is selected (that is, a V mark should precede the Filter 2 option). 


If you select two filters with the AND option, the station must fulfill 
the conditions defined by both filters to be included in the report. If 
you select the OR option, the station is displayed if it meets the 
conditions of either filter. 


5. To specify the conditions for a filter, move to the panel to the right of the 
Filter option. There are two lists on the panel. Follow these steps to select 
the items on the lists: 


a. 


You can limit the stations to be included in the report based on any | 
of these criteria: Sort Position, Name, Partner’s name, Frames, 
Errors, Bytes, Average size, First activity, Last activity, Elapsed 
activity, Address, Absolute usage, and Relative usage. They are 
shown in the second list on the panel. | 


For example, you can specify that the station be included only if its 
average frame size is between 100 and 1,000. 


To specify a criterion, follow these steps: 


1) Move to the desired item on the second list and press Enter. A 
dialog box appears. The dialog box shows the default minimum 
and maximum values. 


2) Move tothe value you want to modify, then press Enter. Another _ 
dialog box appears. 


3) Type the desired value and then press Enter. The dialog box with 
the values that you set appears. Press Esc or F6 to return to the 
menu. 


(For the Talkers report, you would select the Sort Position as Filter 
1 and specify a minimum value of 1 and a maximum value of 10 to 
include the top 10 users.) 


The first list determines the direction of traffic to which the criterion 
you specified in step a applies. If you specified Frames in step a, 
determine whether this condition should apply to the traffic from or 
to the station, or the traffic in both directions. For example, you can 
specify that the monitor count only the stations transmitting frames 
whose average size is between 100 and 1,000 bytes. 


To specify the direction, move to To, From, or Both in the first list. 
Then press the Spacebar. 


After changing a filter value, immediately press Cursor Left to return 
to the Filter 1 option. This ensures that you do not accidentally 
change the new value by viewing other filter values. 


If you are specifying two filters, repeat this step for the second filter. 


To define a report's file format: 


In the Report settings menu, press the Spacebar to enable or disable the 
Delimited format option. (If the Main Menu is currently displayed, go to the 
Report \ Edit menu to set the Delimited format option.) 


© 


Recommendations on Report Editing 


To refine a report's appearance : 


1, 


Add or delete blank lines or special characters like up, down, right, or left 
ruling lines. 


a. 


To add or delete lines, use the F3 (Insert line) or F4 (Delete line) keys. 


b. To add headers, use the cursor keys to position the cursor above the 


fields you want to describe. Then type in the text. 


To add special characters, press F7 (Chars) to display a list of 
available characters. Move to the desired character and press Enter. 
To repeat the character, use the cursor keys to position the cursor on 
the character and press F8 (Repeat chars) to make a continuous line 
or other special display. 


To see how the report will appear with statistics, press F9 (Screen test). 


Press Esc to return to the script. You can now make any additional 
changes to the report script. 


To print or save the report, press F6 (Edit options). A list of edit options appears. 
Move to Print, and then either designate a printer or choose File. (See “Printing 
a Report Manually” on page 6-17 and “Saving a Report to Disk” on page 6-19 
for a description of the associated options.) 


Recommendations on Report Editing 


—_ 


The following i isa list of recommendations that might help you edit a report 


script: 


If you are modifying an existing report script, remember to edit the text 
preceding the statistics after you set up the fields so that the text 
correctly describes the report. 


When you view the statistics, it would be helpful if the sort key is 
consistent with one of the fields included in the report script. 


For example, the LISTENRS report script includes the TBYTE field, 
which represents the number of bytes sent to each of the stations in the 
report. It is recommended that you sort the statistics using the To 
option. In this way, the statistics represented by TBYTE are sorted in 
descending or ascending order, depending on your choice. 


If you sort the statistics using the From option, the stations are arranged 
according to the amount of traffic transmitted. This makes the report 
hard to read because none of the statistics in the report are related to 
transmissions. 


Use the AND operator carefully if you are defining two filters. When 
used correctly, it can eliminate the stations that you are not interested 
in. However, it may yield unexpected results if you inadvertently 
define conflicting conditions for the filters. 


The following are examples showing how the filters interact with the 
AND operator for the LISTENRS report script: 


[Network] 6-25 | 


Sniffer Network Analyzer: Token-Ring Monitor Operations 


Saving a Report Script 


6-26 


Example 1 


For filter 1, To and Average size are selected. The minimum and 
maximum frame sizes are 0 and 500, respectively. 


For filter 2, To and Errors are selected. The minimum and maximum 
numbers of errors are 1 and 65,535, respectively. 


The report generated by the LISTENRS report script counts only the 
stations that have received frames whose average size is 500 bytes or 
less and that have received between 1 and 65,535 error frames. You are 
eliminating the stations that have not transmitted error frames as well 
as the stations that transmit large frames. 


Example 2 
Filter 1 has the same conditions as in Example 1. 


For filter 2, To and Average size are selected. The minimum frame size 
is 600; the maximum is a value that is greater than 600 (for example, 
1,000). 


The report generated by the LISTENRS report script contains no 
statistics because no station can meet the criteria defined by these 
filters. That is, no station can receive frames whose average size is 500 
bytes or less and 600 bytes or more. 


Example 3 


For filter 1, Sort position is selected. The minimum and maximum 
values are 1 and 5, respectively. 


For filter 2, To and Errors are selected. The minimum and maximum 
numbers of errors are 100 and 500, respectively. 


The report generated by the LISTENRS report script would probably 
contain no statistics. If the statistics are sorted by the frames received by 
the stations, a station is displayed only if it is one of the top 5 stations 
that receive most traffic and it has transmitted between 100 and 500 
error frames. 


When you finish editing a report script, you can save that script for future use. 
The original script you used as a basis is not changed; instead, you save the 
edited version under a new name. 


To save a report script: 


1. 


With the report script displayed, press Fé (Report Options), move to 
Save, and press Enter. 


In the dialog box that appears, type the report script name and press 
Enter. 


The monitor saves the report script and assigns it the extension SCR. The 
next time you try to load a report script, this script appears on the list of 
scripts available. 
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Establishing a Baseline for Your Network 


Overview 


Determining what is wrong with the network is much easier when you are 
familiar with typical network patterns before a problem occurs. Significant 
deviations from these patterns often indicate a problem. To decide whether 
such deviations exist, do the following: 


¢ Name the stations on the network. 


For further information on how to name stations, refer to Chapter 4, 
“Managing the Station Data Files.” 


* Become familiar with normal traffic patterns. 


This chapter describes the tests that produce results to be used as a baseline for 
your network. It does not, however, provide detailed interpretation of statistical 
displays and views generated by the monitor. This information is provided in 

Chapter 9, “The Monitor Menu Items.” 


The procedures in this chapter assume that you already know how to move 
through menus, select options, and define values. 


Gathering History Statistics 


TON 
OY 
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To establish a picture of typical network traffic patterns: 


1. Monitor all stations at 30-minute history intervals over a period of time, 
between one day to one week. 


Longer intervals like 30 minutes are often more meaningful because they 
reduce the effects of short-term fluctuations. 


2. Select Global history in the Display menu to look at the Global History 
Statistics view. The statistics allow you to analyze the network usage 
during various time periods. 


Alternatively, enable the Log to disk option in the History menu. The file 
HISTORY.LOG is created in the C:\TRHIST directory, which stores the 
statistics in the Global History Statistics view. 


It might be useful to log history statistics at different times of the year to discern 
network usage patterns. For example, you might want to know whether 
network traffic is heavier toward the end of each fiscal quarter within your 
organization. 


To display history statistics for a particular station: 


1. After monitoring the network over a period of time, select Stn in the 
History menu. 


2. From the station list, select a station for which history statistics will be 
displayed. 


[Network 7-3 


Sniffer Network Analyzer:Token-Ring Monitor Operations 


7-4 


Ke 
X 


3. Select Station history in the Display menu to look at the history statistics 
for the selected station. 


When you display a station’s history statistics, you can specify whether the 
statistics are compiled according to the amount of traffic received or transmitted 
by the station, or both. 


In most cases, use the Both option to show a more accurate picture of network 
activity. With this option, the monitor displays history statistics that reflect the 
traffic to and from the station. You can use this information to balance the load 
among network stations. 


The From option is useful when you display or sort by errors. It provides the 
most accurate picture of which stations are transmitting soft error report frames. 
The To option might be useful for comparing the sizes of frames sent to the file 
servers to those transmitted by the file servers. 


To generate a history report for a particular station: 


To maintain a permanent record of the history statistics for a particular station, 
create a report script and generate a report for these statistics. 


For example, if ServerA generates the most traffic on the network, you might 
want to know its network usage at different times of the day over a period of 
time (for example, a week). To generate a history report for ServerA, follow 
these steps: 


1. Select Edit in the Report menu to display a blank report. 
2. Enter text that describes the content of the report. 


3. Insert fields such as the current time, frames from and to ServerA, 
absolute network usage, and error frames. 


4. Press F6 to display the edit options. 


Select Report settings to set Filter 1. Select Name to limit the report to 
ServerA. (That is, set both the minimum and maximum values of Name 
to “ServerA.”) Make sure that Filter 2 is disabled. 


Select Save to save the script under a filename of your choice. 


7. Select Auto print to print the report to a single file on the disk every hour. 
Set Start time to a time when you want the monitor to start printing the 
report. 


8. Enable the Restart monitor option so that the monitor starts a new 
monitoring session each time it prints the report to the disk. 


After monitoring the network for a week, print out the file that contains the 
report. The report consists of the hourly history statistics for ServerA in the past 
week. You can now see the traffic patterns of this server at different times of the 
day. 


Protocol-Specific Station Tests 


Protocol-Specific Station Tests 


It is useful to test protocols to which each station responds so that when 
connectivity problems occur in the future, you know which station normally 
responds to a particular type of test frame. 


ALAN To perform a protocol-specific station test: 
OG 1. Stop monitoring. 
2. Select Station test. 
3. Choose a station from the station list. 
4. Select the protocol with which you want to test the selected station. The 


Rejected Receives Q 
Rejected Transmissions g Max. Free Command Blocks 
Receive Errors Q 
successful Receives 1,033,321 


available protocols are MAC, IEEE 802.2, NetWare, and NetBIOS. (The 
NetWare and NetBIOS options are available only if you have a second 
network interface card with either the NetWare or NetBIOS software.) 


The monitor displays a message indicating whether the station 
responded. If you started a NetBIOS station test and the station 
responded, the Network Adapter Status screen appears. An example of 
this screen is shown in Figure 7-1. 


Record the test result. 


Network Adapter Status 


Station Address: @287G183A6DC Version: 8x@223 Minutes Active: 4159 


Traffic Statistics Station Resources 
Free Command Blocks 


Max. Configured NCB 
Pending Sessions 


Aborted Transmissions 7 Max. Pending Sessions 
Transmission Errors g Pending Sessions 


successful Transmits 1,833,325 Max. Data Packet Size 
Response Timer Expired g Number of Local Names 


Name Table 


NGCT787444 


==Press ESC to sce == 


Figure 7-1. Sample Network Adapter Status screen. 


Examining Typical Frame Size Distributions 


It is useful to know the typical frame size patterns on the network. Suppose a 
majority of the frames on your network typically fall in the range between 33 
and 64 bytes. After installing a new network application (for example, a file 


[Networ| 7-5 


Sniffer Network Analyzer:Token-Ring Monitor Operations 


transfer program), most frames fall in the range between 2,049 and 4,096 bytes. 
This change indicates that the introduction of the program had an impact on 
network traffic. This information can help you decide whether modification of 
the network configuration is required. 


To examine the frame size distribution, monitor the network over a period of 
time. Then select Frame sizes in the Display menu to look at the Frame Size 
view. If you want to look at the frame size distribution over a period of time, 
generate reports based on FRAMSIZE.SCR regularly. 


If you want to know the average frame size for each station, select All stations 
in the Display menu. Specify that the statistics be sorted by the average frame 
size. 


Examining the Transmit Timer 
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With the access control scheme on a Token-Ring network, a token is always in 
circulation. If a message is already on its way from one station to another, the 
token is set as a busy token. A station must first get a free token before it can 
transmit on the network. 


The time a station needs to wait for a free token before transmitting a frame is 
longer as the network becomes busier. The transmit timer on the monitor 
indicates the length of time between two frames sent to the network, one after 
another. 


It is recommended that you record the length of the waiting time during normal 
and peak hours. In the future, if you notice that the waiting time has become 
significantly longer, you might want to consider changing the network 
configuration to speed up the transmission process. For example, you might 
want to divide one network segment into two or three segments. 


To examine the transmit timer, stop the monitoring session and then select 
Transmit Timer on the Main Menu. A screen display shows the amount of time 
the monitor waits between the transmission of two frames. The time is 
measured in milliseconds. 
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General 


The Monitor Data Files 


Overview 


Data Files 


> 


STARTUP.TRA 


This chapter describes data files on the Sniffer Network Analyzer that are used 
by the monitor. Some of the files are shipped with the product; some are created 
when you execute particular commands in the monitor’s menus. This chapter, 
however, does not describe those files that are used exclusively for the 
operation of the monitor and that you would not typically view in DOS. 


The following list shows the different directories that contain the data files: 


C:\TRSNIFF STARTUP.TRA 
STARTUP.TRD 
STARTUP.TRI 

| STARTUP.TRT 

C:\TRALARMS ALARM.LOG 

C:\TRHIST HISTORY.LOG 
HISTORY.CSV 

C:\ TRREPORT *.RPT 
*.CSV 

C:\ TRREPORT\SCRIPTS * SCR 


The monitor creates duplicates of the STARTUP.TRA and STARTUP.TRD files 
when you change these files for the first time after starting the monitor. The 
duplicates are called BACKUP.TRA and BACKUP.TRD, respectively. As a 
result, you can return to the previous version of the data files. 


The STARTUP.TRD and STARTUP.TRI files are also used by the analyzer. 


File type: ASCII. 


Content: Station addresses and alarm thresholds. This file is not 
shipped with the monitor; instead, it is created during the 
first monitoring session, when the monitor adds any 
named stations to this file and assigns them the default 
alarm thresholds. 


The following is an example of an entry: 


station C00000000001 alarms (usage 20%, badpkts 5, idle 
1 mins, norsp 7 secs, priority 1) 


= 
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Refer to “Station Alarm Threshold Options” on page 5-7 
for information on interpreting the alarm thresholds. 


Read: When you start a monitoring session. 
Written: When you exit the Manage Station Information view after 
making changes. 
STARTUP.TRD 
File type: ASCII. 
Content: Station names and addresses. You can enter station 


names automatically (if you use NetBIOS), with the 
Manage Stations Information view, or with a text editor. 


The following is an example of an entry: 
station “NetBIOS” = c00000000080 


Read: When you start a monitoring session. It is also read by the 
analyzer when you use the analysis function. 


Written: When you use the Probe for names function to add 
station names. 


When you exit the Manage Station Information view after 
editing names. 


When you edit the file with a text editor. 


= You cannot delete the broadcast address, cOQOOffffffff, from this file, because, 
without the address, statistics cannot be kept properly. You can, however, 
change the name for this address. The default name is Broadcast. 


STARTUP.TRI 
File type: ASCII. 


Content: Vendor addresses, each of which makes up the first six 
hexadecimal numbers of a station’s address. The monitor 
is shipped with a set of addresses in STARTUP.TRI. The 
following is an example of an entry: 


manuf “Vtalnk” = 48007c 


_ Ifa monitor display includes the station whose address is, 
for example, 48007c123456, the monitor displays 
“Vtalnk123456” instead of the 12 hexadecimal digits. 


The maximum number of entries is 225. 


Read: When you start the monitor. It is also read by the analyzer 
if you use its analysis function. 


Written: When you save changes made with a text editor. (The 
monitor does not automatically change this file.) 
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STARTUP.TRT 


ALARM.LOG 


File type: 


Content: 


Read: 
Written: 


File type: 


Content: 
Read: 
Written: 


STARTUP.TRT 


ASCII. 


SAP values in hexadecimal numbers. The monitor is 
shipped with default SAP values in STARTUP.TRT. You 
can assign more than one SAP value to a protocol type as 
shown in these examples: 


sap “SNA” = 04 
sap “SNA” = 08 


The maximum number of entries is 64 (32 SAP and 32 
Ethertype); the maximum number of SAP labels for each 
type (SAP and Ethertype) is 16. Each label can have 4SAP 
numbers. 


When you start the monitor. 


When you save changes made with a text editor. (The 
monitor does not automatically change this file.) 


ASCII. 
Alarms in the monitor's alarm buffer. 
When you use a word processor to read the file. 


The monitor saves alarms from the alarm buffer to the file 
if you enable the File option in the Alarm \Log to menu. 


HISTORY.LOG and HISTORY.CSV 


The monitor saves history statistics to C:\TRHIST \HISTORY.LOG if you do 
not specify the delimited (spreadsheet-compatible) format; it saves the statistics 
to C:\TRHIST \ HISTORY.CSV if you choose the delimited format. 


*.CSV and *.RPT 


File type: 
Content: 
Read: 
Written: 


ASCII. 
Global history statistics. 
When you use a text editor to read the file. 


The monitor saves global history statistics regularly to the 
file if you enable the Log to disk option in the History 
menu. 


The *.CSV and *.RPT files are reports stored in the C:\TRREPORT directory. 
Figure 8-1 lists the different forms of filenames. 
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*,SCR 
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YYMMDDNN.RPT 
Figure 8-1. Filenames in the C:\ TRREPORT directory. 


Report Format Generated Generated Manually 
Automatically 
cass ARYYMMDD.CSV or 
Delimited YYMMDDNN CSV FILENAME.CSV 
Not delimited ARYYMMDD.RPT or | ErEENAME.RPT 


You specify FILENAME when you manually generate the report. If the monitor 
generates the report automatically, the filename indicates the file creation date. 


File type: ASCII. 


Content: The report generated. 
Read: When you use a text editor to open it. 
Written: When a report is automatically or manually generated. 


There are several report script files under the C:\TRREPORT\SCRIPTS 
directory (for example, HISTORY.SCR, ERRORS.SCR). 


File type: Binary. 

Content: Report script that the monitor uses as a template when 
generating a report. 

Read: When you choose Load in the Report menu. 

Written: When you choose Save in the Report menu. 
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Network 
General 


The Monitor Menu Items 


Overview 


Transmit Timer 


This chapter describes each menu item in the order it appears in the monitor's 
Main Menu, along with any associated options. For options that display 
additional information, such as the Global Statistics view associated with the 
Display option, there is also an explanation of each item in the view. 


This chapter does not discuss the use of function keys in each view (for example, 
F9 for freezing the screen). It assumes that you have learned how to use the 
function keys from the previous chapters. 


Generates the Transmit Wait Time view, which shows the amount of time the 
monitor takes to acquire the token before each transmission. Select Transmit 
Timer only when the monitor is not monitoring. Figure 9-1 is an example of the 
Transmit Wait Time view. 


TRANSMIT WAIT TIME 


Current Transmit Wait Time: 24.2 milliseconds 


W 
a 
i 
t 
it 
i 
m 
e 
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Figure 9-1. Transmit Wait Time view. 


The following list explains the terms used in the display: 


¢ Current Transmit Wait Time is the amount of time in milliseconds that 
the monitor waited to acquire the token for the most recent 
transmission. 
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¢ Wait Time is used on the vertical axis of the bar graph. It indicates the 
amount of time in milliseconds that the monitor waited to acquire the 
token for each transmission in the past 60 seconds. The monitor 
transmits 20 frames per second and averages the wait times. The time 
intervals are marked on the horizontal axis of the graph. 


Station Test 


Tests for station response, using the protocols listed below. 


If the station responds to a NetBIOS test frame, the Network Adapter Status 
screen appears. Refer to Figure 7-1 for an example. 


If you use other protocols, the monitor displays a message similar to the 
following to indicate that the station responded: 


File Server responded. 


Options 
To = Displays the name or address of the station to be tested. If 
you press Enter after selecting this option, a list appears. 
Choose the station you want to test. To move through the 
list quickly, type the first character of the station’s name. 


MAC Sends a test frame at the MAC level. 
IEEE 802.2 Sends an 802.2 test frame. 
NetWare Performs a NetWare configuration request command. 


This option operates only when you have installed a 
second network interface card with the NetWare 
software. 


NetBIOS Performs a NetBIOS remote status request command. 
This option operates only when you have installed a 
second network interface card with the NetBIOS 
software. 


The monitor can perform a station test using the NetWare or NetBIOS protocol 
when it is monitoring the network. You must, however, stop the monitor before 
initiating a station test for the MAC or IEEE 802.2 protocol. 


Monitor Filters 
Determines which stations and which types of frames are to be monitored. You 


can change the settings of Monitor filters only when the monitor is not 
monitoring. 


Options 


All stations Monitors all stations. 
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History 


History 


Options 


Stn = 


All frames 
LLC frames 
MAC frames 


Displays the name or address of the station to be 
monitored. If you press Enter when this option is selected, 
a station list appears. Choose the station you want to 
monitor. To move through the list quickly, type the first 
character of the station’s name. 


Monitors both LLC and MAC frames. 
Monitors only LLC frames. 
Monitors only MAC frames. 


By default, Monitor filters is set to All stations and All frames. 


Specifies the history interval and designates a station for which history statistics 
are collected. The history interval determines how often the monitor records 
history statistics. The total number of intervals is set in the Configuration Menu. 


The default is 1,750. 


Changing the setting of a History option erases any previous history statistics 
in memory. To save them, generate a report or log history statistics to disk. 


Stn 


Intrvl 


Align history 


Displays the name of a station for which the monitor 
collects statistics. If you press Enter when this option is 
selected, a station list appears for you to choose a station. 
To move through the list quickly, type the first character 
of the station’s name. 


Specifies the length of a time interval during which the 
monitor accumulates statistics. It also affects when the 
monitor starts collecting history statistics, as explained in 
Figure 9-2. 


To specify the value, press Enter to display a dialog box. 
Specify the time in the hh:mm:ss format. The value can 
range from 5 seconds to 24 hours. 


If it is not selected, the monitor starts collecting history 
statistics immediately. 


If it is selected, the monitor starts collecting history 
statistics on the next interval boundary. For example, if 
you set Intrvl to 10 minutes and the current time is 
02:21:00, the monitor starts collecting statistics at 02:30:00. 
Figure 9-2 describes how the value of Intrvl affects the 
time the monitor starts history statistics collection. 
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If Intrvl is set to ... 


24 hours 
12 hours 


Any number of hours 
(for example, 1, 2) 


5,10, 15, 20, or 30 minutes 


Any number of minutes 
other than the ones 
described above 


5,10, 15, 20, or 30 seconds 


History statistics collection starts at... 
Midnight. 
Noon or midnight. 


Beginning of the next hour. 


Next specified boundary. For example, if 
the current time is 05:13:00 and you set 
Intrvl to 30 minutes, statistics collection 
starts at 05:30:00. 


Beginning of the next minute. For example, 
if the current time is 05:13:00 and you set 
Intrvl to 2 minutes, statistics collection 
starts at 05:14:00. 


Next specified boundary. For example, if 


the current time is 05:13:25, and you set 
Intrvl to 15 seconds, statistics collection 
starts at 05:13:30. 


Any value other than the | Immediately. 
ones described above 


Figure 9-2. Relationshtp between Intrvl and history alignment. 


Log to disk When selected, this option writes global history statistics 
at each history interval to a file on disk named 
HISTORY.LOG, which is in the C:\TRHIST directory. At 
midnight, this file is renamed to GHYYMMDD.LOG 
(YYMMDD represents the year, month, and day). The 
monitor then clears the contents of HISTORY.LOG so that 
it can store to this file the history statistics for the next 
day. (If the file is in delimited format, the file extension is 
CSV instead of LOG.) 


When Delimited format is selected, the file’s format is 
compatible with spreadsheet applications. That is, 
embedded commas within numbers are eliminated, and 
the fields are separated from each other by commas. The 
name of the file is HISTORY.CSV. 


Both HISTORY.LOG and HISTORY.CSV contain the 
same information as shown in the numeric Global History 
Statistics view. 


By default, Stn is set to Broadcast and Intrvl to 00:15:00. Align history is 
selected, but Log to disk is not. 
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Display 


Options 


Display 


Display generates a variety of screens containing network statistics. Each 
display is called a “view.” The exact information in each view depends on the 
options you choose. All views include the current date and time in the upper- 
right corner of the screen. 


The following is a list of options for Display, which allow you to specify the 
type of view to be generated: 


Global statistics Displays traffic statistics for the network as a whole. 

Single station Displays traffic statistics for a specific station. 

All stations Displays selected statistics, sorted according to your 
specifications, for all stations. 

Frame sizes Displays a distribution of frame sizes. 

Routing info Displays statistics on routed frames. 

SAP protocol types Displays the numbers of frames or bytes according 
to the type of SAP. 

Alarm log Displays a list of alarms generated in the current 
monitoring session that have not been cleared. 

Global history Displays a history of activity for the entire network. 

Station history Displays a history of activity for a specific station. 


For all options, except Frame sizes and Alarm log, you can determine how 
statistics are displayed (for example, in numeric or graphic format). The 
following subsections describe the views generated by these options. 


The Class option specifies whether the statistics in a view are based on the 
frames sent to the station, from the station, or both. This option applies when 
you display a single station (in the graphic format), all stations, or station 
history. 


The Network Usage option specifies whether the statistics are absolute (a 
portion of the total network capacity) or relative (a portion of the total network 
traffic). This option applies when you display a single station, all stations, or 
station history. 


Display Global Statistics 


The Global Statistics view provides a high-level view of network activity for all 
stations for the current monitoring session. 
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Options 


Numeric 


Graphic 


Global Statistics In Numeric Format 


Displays global statistics as columns of numbers, 
including updated traffic counts, error counts, and 
timestamps. Numeric is the default setting. 


Displays traffic counts in the top portion and a 
graph of absolute network usage over a 60-second 
period in the bottom portion. 


Figure 9-3 is an example of a Global Statistics view in the numeric format. 


Traffic Counts 


The Traffic Counts column is divided into two parts. 


The following list explains the terms in the left column. All the statistics in this 
column have been accumulated since the current monitoring session started. 


Maximum Inserted Stns 


Total Stations 


Average Usage 
Total Frames 
Total Bytes 


Avg Frame Size 


Highest number of inserted stations at one time in 
the current monitoring session. An inserted station 
is one whose status is active monitor, standby 
monitor, or snooper. For further information on 
station status, refer to “ All Stations Statistics in 
Numeric Format” on page 9-16. 


Number of stations that have transmitted in the 
current monitoring session. This number is equal to 
or greater than Maximum Inserted Stns. 


Average utilization of the network’s capacity. 
Total number of frames transmitted. 
Total number of bytes transmitted. 


Average size of transmitted frames (that is, total 
bytes divided by total frames). 


The following list explains the terms in the right column. All the statistics in this 
column pertain to the last second: 


Current Inserted Stns 


Active Stations 


Current Usage 
Current Frames 
Current Bytes 


Avg Frame Size 


Number of inserted stations. 


Number of stations that have transmitted frames of 
any type. 

Utilization of the network's capacity. 

Number of frames transmitted. 


Number of bytes transmitted. 


Average size of transmitted frames (that is, current 
bytes divided by current frames). 


Display 


LOBAL STATISTICS _————— Oct. 62 17:94:59 
Traffic Counts 


Maximum Inserted Stns Current Inserted Stns 
Total Stations Active Stations 
Average Usage Current Usage 

Total Frames Current Frames 

Total Bytes Current Bytes 

Avg Frame Size 18 Avg Frame Size 


Error Counts | Timestamps 


Ring State Operating Normally Monitor Started Oct @2 17:04:44 
Monitor Active @ day(s) 60:08:15 
Oversized Frames 


Ring Purges First Activity Oct 02 17:84:45 
Soft Error Reports Last Activity Oct 02 17:84:59 
Network Active 9 day(s) 00:00:14 


9 6Disply 9Freezefil@ Stop 
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Figure 9-3. Global statistics view (numeric format). 


Error Counts 


The Error Counts column shows the overall condition of the network and the 
numbers of errors. 


Ring State The general condition of the network. The following 
explains the possible messages displayed for Ring State: 


“Beaconing” indicates that the network is inoperable. A 
network can be in the beaconing state because of a 
physical break in the network or a time-out during 
monitor contention. 


“Monitor Contention” indicates that the network is in the 
process of selecting a new active monitor. This happens 

when the current active monitor has not received its Ring 
Purge MAC frame within one second of its transmission. 


“No Receive Signal” indicates that the monitor receives 
no signals from the network. This happens when the 
monitor station is disconnected from the network. 


“Operating Normally” indicates that the network is in 
normal operation. (That is, an active monitor is present, 
and a token is being circulated on the network.) 


“Removed from Ring” indicates that the monitor is 
prevented from entering the Token-Ring because the IBM 
LAN Manager program is not configured to allow a 
monitoring device to be present on the network. 
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Oversized Frames 


Ring Purges 


Soft Error Reports 


“Ring Purge” indicates that the active monitor has sent 
out a Ring Purge MAC frame because it detected that a 
token has been lost. 


“Not monitoring” indicates that the monitor is not 
monitoring the network. 


Number of frames that exceed 4,608 bytes on a 4 Mb/s 
network or that exceed 18,432 bytes on a 16 Mb/s 
network. 


Number of times the active monitor purges any 
circulating information from the ring because it has not 
seen a free token or a good frame within 10 milliseconds. 


Number of intermittent errors counted and reported by 
the Token-Ring adapters on the network. There are 
different types of soft errors. For example, a line error 
indicates that there was an invalid character in a frame or 
token or that there was a checksum error in a frame; a lost 
frame error indicates that a station that transmitted a 
frame failed to receive the frame. 


For further information on soft errors and error recovery, refer to the TMS380 
Adapter Chipset User's Guide or Token-Ring Network, Architecture Reference. 


Timestamps 
Monitor Started 


Monitor Active 
First Activity 
Last Activity 


Network Active 


Global Statistics In Graphic Format 


Date and time the current monitoring session started. 
Length of the current monitoring session. 

Date and time the first frame was transmitted. 

Date and time the most recent frame was transmitted. 


Amount of time between the first and most recent frames 
transmitted. 


Figure 9-4 is an example of a Global Statistics view in the graphic format. 


The top portion of the view displays traffic counts identical to those in the 
numeric view. The graph in the bottom portion shows absolute network usage 
(in percentage) over a 60-second period. The graph updates at one-second © 
intervals, moving across the view from right to left. The current time and date 
display in the upper-right corner of the view. 
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Display 


LOBAL STATISTICS ———AA Occ. 82 17:06:52 
Traffic Counts 

Maximum Inserted Stns 26 Current Inserted Stns 

Total Stations 26 Active Stations 

Average Usage 9.07 % Current Usage 

Total Frames 22,887 Current Frames 

Total Bytes 5,808,297 Current Bytes 

Avg Frame Size 262 Avg Frame Size 


AAAAAAA———A—AAAAA—A——A-A~A 


49 30 
Seconds 
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Figure 9-4. Global statistics (graphic format). 


The monitor can display accurate statistics up to certain values. It displays 
“Ovrflw” instead of the numeric value when a statistic has exceeded the 
maximum value. 


The maximum value of Total Frames is 4,294,967,295; the maximum value of 
Total Bytes is 999,999,999,999. The maximum value of each type of error count 
is 65,535. Reset the monitor immediately after “Ovrflw” appears. This way, you 
can examine the accurate statistics in the Global Statistics view for the current 
session. 


Display Single Station 


Options 


This view provides a high-level view of current activity for a selected station. 


Stn The name of the station for which the monitor displays 
statistics. If you press Enter after selecting this option, a 
station list appears. Choose a station from the list. 


Numeric Displays traffic statistics for the selected station as 
columns of numbers, including transmissions, receptions, 
or both (Figure 9-5). 


Graphic Displays traffic statistics for transmissions, receptions, or 
both, depending on the Class option you choose. The 
graph in the bottom portion shows either absolute or 
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relative network usage by the station over a 60-second 
period (Figure 9-6). 


Single Station Statistics in Numeric Format 


9-12 


Figure 9-5 is an example of the display for a single station. 


ABSOLUTE TRAFFIC STATISTICS-SINGLE STATION-———————————Occt. 82 17:22:57. 


Station: File Server 
Status: Active Mon 


Last sent to: Alex Zwick 
Last rcv from: Ken Quinn 


Traffic FROM Station 


Current Usage 
Average Usage 


Traffic TO and FROM Station 
Current Usage 5.18 % 
Average Usage 6.53 % 
Total Frames 138,827 
Total Errors 24 
Total Bytes 35,697,892 
Avg Frame Size 274 


Traffic TO Station 


Current Usage 3.28 % 
Average Usage 5.02 % 


Total Frames 
Total Errors 
Total Bytes 


Avg Frame Size 


Start Time 
End Time 


Total Frames 65,622 


8,258, 712 Total Bytes 27,447,188 
128 418 


Avg Frame Size 


Oct 02 17:04:45 Start Time Oct @2 17:04:45 
Oct 02 17:22:57 End Time Oct. 2 17:22:57 


Elapsed ® day(s) 00:18:12 Elapsed ® day(s) 00:18:12 
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Figure 9-5. Single station statistics (numeric format). 


The top portion shows traffic counts for both transmissions and receptions for 
a selected station. The lower-left portion shows counts for transmissions; the 
lower-right portion shows counts for receptions. 


The left column in the top portion displays the following types of general 


information: 
Station 


Last sent to 


Last rcv from 


Address or name of the station for which statistics appear. 


Address or name of the station to which the most recent 
frame was transmitted. 


Address or name of the station from which the most 
recent frame was received. 


Traffic TO and FROM Station 


Current Usage 
Average Usage 


Total Frames 


Percentage of utilization in the last second for both 
transmissions and receptions. 


Average percentage of utilization for both transmissions 
and receptions in this monitoring session. 


Total number of frames transmitted and received. 


Total Errors 
Total Bytes 


Avg Frame Size 


FROM Station 
Current Usage 


Average Usage 


Total Frames 
Total Errors 
Total Bytes 
Avg Frame Size 
Start Time 

End Time 
Elapsed 


TO Station 
Current Usage 


Average Usage 


Total Frames 
Total Bytes 
Avg Frame Size 
Start Time 

End Time 
Elapsed 


Single Station Statistics In Graphic Format 


Display 


Total number of soft error report frames transmitted. 
Total number of bytes transmitted and received. 


Average size of frames transmitted and received. 


Percentage of network utilization for transmissions in the 
last second. 


Average percentage of utilization for transmissions in this 
monitoring session. 


Total number of frames transmitted. 

Total number of soft error reports transmitted. 

Total number of bytes transmitted. 

Average size of frames transmitted. 

Date and time the first frame was transmitted. 

Date and time the most recent frame was transmitted. 


Amount of time between the transmission of the first and 
most recent frames. 


Percentage of utilization for receptions in the last second. 


Average percentage of utilization for receptions in this 
monitoring session. 


Total number of frames received. 

Total number of bytes received. 

Average size of frames received. 

Date and time the first frame was received. 

Date and time the most recent frame was received. 


Amount of time between the first and most recent frames 
received. 


Figure 9-6 is an example of the display for a single station in the graphic format. 


The statistics in the top portion of the graphic view are similar to those 
displayed in one of the portions in the numeric view. However, they do not 
always describe the traffic both to and from the station; the statistics displayed 
depend on the Class option you choose. 


For example, if you choose To for the Class option, the display does not include 
the address or name of the station to which the most recent frame was 
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Recommendations 


9-14 


transmitted (the “Last sent to” field). The number of errors (the “Total Errors” 
field) is displayed only if Both or From is selected for Class. 


ABSOLUTE TRAFFIC STATISTICS-SINGLE STATION-———————————Occt. 92 17:31:24 
Traffic TO and FROM Station 
Station: File Server Current Usage 2 
State: Monitor Average Usage 
Total Frames 
Last sent to: Jill Franz Total Errors 
Last rcv from: Barney Ingram Total Bytes 52,647,364 
Avg Frame Size 269 
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Menus foptions™ up down §{displaysimonitor 


Figure 9-6. Single station statistics (graphic format). 


The graph in the bottom portion of the Single Station view (Figure 9-6) shows 
either absolute or relative network usage (in percentage) by the station over a 
60-second period. The graph updates at one-second intervals, moving across 
the view from right to left. 


If you select Both for the Class option, a bar in the graph representing both 
reception and transmission statistics is made up of two portions. The upper 
portion represents the reception statistics; the lower portion represents the 
transmission statistics. A color monitor displays reception statistics in yellow 
and transmission statistics in blue. 


As with the global statistics, the monitor can display accurate statistics for a 
single station up to certain values. If a statistic for both reception and 
transmission exceeds the maximum value, the monitor displays “Ovrflw” 
instead of the numeric value. For example, “Ovrflw” appears when Total 
Frames in the Traffic TO and FROM Station column exceeds 4,294,967,295. 


However, if the number of the transmitted frames or received frames exceeds 
the maximum value, the monitor does not display “Ovrflw.” In this case, the 
numeric value displayed is still inaccurate. 


If you display the numeric view, reset the monitor once “Ovrflw” is displayed. 
If you display the graphic view for transmission or reception traffic only, there 
is no warning about the overflow of the frame counts. In this case, it is important 


Display 


Display All Stations 


Options 


that you reset the monitor once “Ovrflw” is displayed for Total Frames in the 
Global Statistics view. When Total Frames overflows, it is possible that the 
frame counts for one or more stations are inaccurate. 


This view shows statistics for each station across the network, sorted according 
to your specification. 


Numeric Displays statistics as columns of numbers, for up to 20 
stations at a time. You can choose which statistics to 
display (see “ All Stations Statistics in Numeric Format” 
on page 9-16), how to display them, and how to sort 
them. 


Graphic Displays a graph and lists 10 stations at a time. (Refer to 
“All Statistics in Graphic Format” later in this section for 
a description of the view.) 


Sort by Specifies the order in which the statistics are arranged 
and the key by which the statistics are sorted. The options 
available are described below: 


Ascending displays statistics from the lowest to the 
highest, as defined by the sort key. 


Descending displays statistics from the highest to the 
lowest, as defined by the sort key. 


Name sorts the stations by their names. 


Partner's name sorts the stations by the names of their 
partners. A station’s partner is the last station it 
_ communicated with. 


Ring order sorts the stations according to the order of the 
stations on the Token- Ring. When Ring order is selected, 
the active monitor is displayed first, followed by the 
standby monitors. The standby monitors are arranged in 
such order that each station is followed by its upstream 
neighbor. 


After the standby monitors, the rest of the stations are 
grouped by station status in this order: snooper, removed, 
remote, inactive, and group. Refer to “All Stations 
Statistics in Numeric Format” on page 9-16 for more 
information on station status. 


The monitor displays a warning message if it cannot 
determine the ring order. | 


Frames sorts the stations by the number of frames 
transmitted, received, or both. 
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Active stns only 


Inserted stns only 


Errors sorts the stations by the number of soft error 
frames transmitted. Do not sort by errors if the setting of 
the Class option is To, or an error message appears. 


Bytes sorts the stations by the total number of bytes 
transmitted, received, or both. 


Average size sorts the stations by the average size of 
frames transmitted, received, or both. 


Network usage sorts the stations by their network usage. 
The usage percentage might fall in the range between 100 
and 200 if the class of traffic is Both because the monitor 
counts each frame for its source and destination. 


First activity sorts the stations by the date and time that 
the first frame was transmitted or received. 


Last activity sorts the stations by the date and time that 
the most recent frame was transmitted or received. 


Elapsed activity sorts the stations by the amount of time 
between the first and last activity. 


Displays only stations that have sent or received traffic 
since the beginning of the current monitoring session. 


Displays only stations whose station status is active 
monitor, standby monitor, or snooper. 


The numeric view always includes the station names. Other types of statistics 
that can be included are: Partner’s name, Station status, Frames, Errors, Bytes, 
Average size, Network usage, First activity, Last activity, and Elapsed activity. 


For definitions of these terms except Station status, refer to the description of 
Sort by earlier in this section. 


Station status refers to the status of the station, which can be one of the 


following: 


Active monitor 


Standby monitor 


Snooper 


Removed 


Remote 


The station serves as the active monitor, which initiates 
the token transmission and provides the soft-error 
recover facility. 


The station serves as a standby monitor, which can detect 
failures in the active monitor and traffic disruptions on 
the network. A standby monitor may become the active 
monitor if the active monitor fails. 


The station is currently sending Trace Tool Present 
frames. (The monitor’s station status is snooper; it sends 
out a Trace Tool Present frame every minute.) 


The station was previously inserted but has left the ring. 


The station is on a remote Token-Ring network. 


Display 


Inactive The station has never transmitted a frame. 


Group The address is not station-specific. For example, it is a 
broadcast address. 


Network usage shows the relative or absolute usage of the network in 
percentage.The percentage might fall in the range between 100 and 200 if the 
class of traffic is Both, because the monitor counts each frame for its source and 
destination. 


Figure 9-7 is an example of anumeric view showing the statistics for all stations. 


ABSOLUTE TRAFFIC STATISTICS TO AND FROM STATIONS -————————Occt. 82 17:42:17 
Station Frames £E Bytes Size Usage 
File Server 276, 689 73,432,466 266 6.51 
Print Server 191,191 45,529,139 238 4,63 
Denise Martin 19,582 18,011,113 919 1.59 
Mark Ellison 19,801 15,513,678 783 1.37 
Ed Hicks 19,389 15,013,438 774 1.33 
Linus Stanwick 19 , 206 14,282,561 743 1.26 
Steven Anderson 19,264 9,802,593 588 9.87 
William Griffith 19,582 6,804,988 347 8.69 
Tom Brown 19,623 6,811,525 306 9.53 
Michael Harley 19,829 4,914,731 248 8.43 
Miles Russell 19,575 2,748,389 146 9.24 
Barbara Lemmon 19,565 2,787,797 0.24 
Bill Goodman 19,619 2,529 , 836 G22 
Barney Ingram 28 , 825 2,226,957 §.19 
Ken Quinn 19,204 2,220, 098 §.19 
Alex Zwick 19,715 1,982,862 6.17 
Helene Milici 19,558 1,947,276 0.17 
George Stanley 19,901 1,796,588 8.15 
Jill Franz 28, 866 1,725, 680 §.15 
Robert Hayes 19,695 1,441,699 8.12 


29 
1 3 Prevl4d Next—is 6Disply 9FreezeflO Stop 
Help stationgistationg Menus fMoptions displaujfmonitor 


Figure 9-7. Statistics for all stations (numeric format). 
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All Stations Statistics in Graphic Format 


Figure 9-8 is an example of a graphic view showing the statistics for all stations. 
The categories of statistics in the graphic view cannot be changed. For example, 
you cannot display the names of the stations’ partners. 


The bottom portion of the graphic view displays absolute or relative network 
usage (in percentage) for up to 10 stations at a time, sorted by the key you 
selected. 


The top portion of the graphic view shows statistics for the displayed stations 
as a graph, with transmissions, receptions, and both counts appearing in 
different colors or intensities. 
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RELATIVE TRAFFIC STATISTICS TO AND FROM STATIONS--———————Oct. 82 18:82:3 
10 pAAAAAA~AA—AA—AAAA——AA——AAAA—AAAA 


8 
ITI Gag 
| IPG 
| ITGPwteiitin 
| | 
2 3 
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4 5 6 7 8 
Legend: TO FROM BOTH 
File Server 61.15 % Linus Stanwick 
Print Server 38.60 % Steven Anderson 
Denise Martin 14,95 % William Griffith 


Mark Ellison 12.95 % Tom Brown 
Ed Hicks 12.48 % Michael Harley 


re 
1 Caach) -Mmchas 6Disply—i? Scale—8 Scalef9Freezeff10 Stop 
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Figure 9-8. Statistics for all stations (graphic format). 


Display Frame Sizes 


Figure 9-9 is an example of the Frame Sizes view on a 4 Mb/s network. 


FRAME S1ZES-—————______—_—____—_Oct 82 18:88:58 


Size Frames Percent @ 20 46 62 88 128 


Under 17 6.20 
6.00 

26.55 

21.02 

20.77 

15.15 

5.87 

513- 1024 2.39 
1825- 2048 5.69 
2049- 4096 2.53 
4097- 4628 ) B20 
Over 4608 0.00 


9 6Disply 9Freeze—™il@ Stop 
Menus foptions displau—monitor 


Figure 9-9. Frame Sizes view. 
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Display 


The Frame Sizes view shows how many frames fall into each predefined size 
category and what percentage of frames each size category comprises. The size 
categories are different on a monitor running at 16 Mb/s. 


Size Displays the size categories (in bytes) used to classify the 
frames. The minimum frame size is 17. The first size 
category is “Under 17”, which counts the number of 
fragments that are smaller than the minimum size. 


Frames Displays the total number of frames for each size 
category. 
Percent Displays the percentage of frames for each size category. 


The graph illustrates these percentages. 


Display Routing Info 
Shows the number of frames routed to and from the local Token-Ring network. 
You can display the Routing Paths view or the Routing Lengths view. 
Routing Paths View 
Figure 9-10 is an example of the Routing Paths view. 
ROUTING PATHS-—————————_____——__——_ENDED:: Oct 38 15:25:2 


Routed frames: 4,756 22.52% 
Non-Routed frames: 16,359 77.47% 


Frames to remote rings 
==Local rin=== 2,150 Remote ring 


Frames on 10.18% Frames passing 
this local ring through local ring 


16,359 Frames from remote rings 553 
1,929 2.61% 


D . B0% 
- To broadcast destinations 
- To group/functional destinations 
- To non-transmitting stations 


3, 6Disply SFreeze—fii@ New 
Menus #options displayfimonitor 


Figure 9-10. Routing Paths view. 


The first two lines of the display show the numbers and percentages of routed 
and non-routed frames. A frame’s source address indicates whether a frame is 
routed or non-routed. If the RII bit (bit 0 of byte 0 in the source address) is 0, the 
frame is non-routed. For further information on source addresses, refer to 
Token-Ring Network, Architecture Reference. 
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Routing Lengths View 


9-20 


The rest of the display breaks down the statistics further. It shows the numbers 
and percentages of routed frames between the local network and the remote 
networks. The box named “Local ring” contains the number and percentage of 
non-routed frames. The box named “Remote rings” contains the number and 
percentage of frames that pass through the local Token-Ring network from 
remote networks. 


Between the “Local ring” and “Remote rings” boxes are two types of statistics. 
“Frames to remote rings” shows the number and percentage of frames sent from 
the local network to a remote network. “Frames from remote rings” shows the 
number and percentage of routed frames that are destined for the local network. 


The frames sent to “Other” can be any of the following types: 
¢ Broadcast frames from the local or remote networks 


¢ Frames that are destined for a group address 


* Frames that have been sent to non-transmitting stations 


Figure 9-11 shows an example of the Routing Lengths view. 


ROUTING LENGTHS ENDED: Oct 38 15:95:2 
Length Frames Percent 9 20 49 6 88 160 


| B08 
2,404 58.54 
1,675 35.21 
993s «41.62 
8.22 
8.08 


won! OV O11. G DF |] 


All Routes 
Other 


— 
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Total 4,756 22.52 % of all frames on local ring are routed 
9 6Disply JFreezemil™ New 
Menus fMoptions displau—monitor 


Figure 9-11. Routing Lengths view. 


The display categorizes the frames according to the length of the route. The 
length is the number of Token-Ring bridges that a frame has traversed. In the 
display, the length can range from 0 to over 12. 


If a frame’s routing length is 0, it means that the frame includes the Routing 
Information field, but the Length Bits in the frame are 0. For further information 


Display Protocols 


Display 


on the Routing Information field and Length Bits, refer to Token-Ring Network, 
Architecture Reference. 


The category “ All Routes” represents the all-routes broadcast frames. These 
frames are sent to all Token-Ring networks that are interconnected with the 
local network by bridges. 


The “Other” category includes these types of frames: 


¢ The number of bridges a frame has traversed cannot be determined, 
and the frame has a destination or source address that does not exist on 
the local network. 


¢ The frame is non-source-routed but it is sent to or received from a non- 
local station. 


The percentages in the display are the percentages of all routed frames. The 
graph illustrates these percentages. 


This view shows a distribution of protocol types used on the network. The 
number and percentage of either bytes or frames can be displayed for all: 


¢ SAP (Service Access Point) protocol types 
¢ Ethertypes (in SNAP SAP) embedded in the type field 


The options SAP Protocols and Ethertype Protocol determine the protocol 
types displayed. The options Bytes and Frames determine whether the statistics 
are displayed in bytes or frames. The percentages indicate how the frames or 
bytes are distributed among the protocol types monitored. The view also 
illustrates these numbers in a bar graph. 


For the Ethertypes view, the options All Frames and SNAP Frames determine 
whether the percentages are based on all frames counted or on only SNAP 
frames counted. When displaying the number of bytes, the percentages are 
based on the number of bytes in either all frames counted or only the SNAP 
frames counted. 


The monitor reads the STARTUP.TRT file for the SAP values. If you want 
breakdowns for protocol types other than those shown, use the DOS command, 
EDLIN, to add protocols to STARTUP.TRT. The file can contain up to 64 entries 
(32 SAP and 32 Ethertype); the maximum number of labels for each type (SAP 
and Ethertype) is 16. Each label can have 4 SAP numbers. 


Figure 9-12 is an example of the SAP Display Protocol view that shows the 
distribution of bytes by protocol type. 


The terms used in the display are: 


SAP/Ethertype Protocol type to which the frame being counted 
belongs. 

Bytes/Frames Number of bytes or frames that fall into a particular 
protocol category. 
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Display Alarm Log 
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% Total Percentage of frames or bytes of a particular 
protocol type. The graph illustrates these 
percentages. | 


3,646,953 
2,816, 468 
8,411,349 

271,418 
5,981,559 
2,278, 766 


63,231 
1,860,640 


5 6Disply s]amcicysc) IE/mae)) 
Menus #options displayfimonitor 


Figure 9-12. SAP Protocol Types view. 


When displaying SAP protocol types, LLC frames that contain the Ethertype 
value in the SNAP (Sub-Network Access Protocol) header are shown as SNAP 
frames regardless of the Ethertype. For example, if the monitor detects an LLC 
frame that encapsulates the Ethertype IP in the SNAP header, it increases the 
byte or frame count under SNAP, not IP, in the Protocol Types (SAPs) view. 


When displaying Ethertypes, LLC frames that contain the Ethertype value in 
the SNAP header are counted as frames in the appropriate protocol type. 


You are allowed to specify multiple values for a protocol type (up to 4SAP 
numbers for each label). For example, STARTUP.TRT can contain the following 
entries: 


sap “SNA” = 04 
sap “SNA” = 08 


When the monitor displays the SAP protocol types, there is one entry for SNA. 
The count under this entry includes all the frames that have the SAP value equal 
to 04 or 08. | 


_ The Alarm Log view lists up to 200 alarms generated in the current monitoring 


session that have not been cleared. From the Alarm Log view, you can 


Display 


acknowledge an alarm by pressing F3 (Ack alarm), and clear it by pressing F4 


(Clear alarm). 


Figure 9-13 is an example of the Alarm Log view. The following list explains the 


fields in the Alarm Log view: 


Priority 
Time 


Source 


Type/ Description 
Ack 


Priority level of the network event that triggered the 
alarm. 


Time and date the event occurred. 


Name of the station that triggered the alarm. 
“Global Network” is displayed if the alarm is a 
global alarm. 


Type of event that triggered the alarm. 


Whether the alarm has been acknowledged 
(indicated by a V mark). 


ALARM LOG et #3 15:25:44 


Priority 


Time 


Critical Oct 93 15:12:18 
LJ ° of 


arning 
Warning 
Warning 
Warning 
Warning 


15:13:43 
15:14:41 
15:24:26 
15:24:55 


Source Type/Description 

Global Network Abs usage exceeded 25% 
ile Server or more error reports 

Print Server 5 or more error reports 

William Griffith 5 or more error reports 

Steven Anderson 5 or more error reports 

Alex Zwick 5 or more error reports 


1 3 Ack §4Clear 5 6Disply 
Help alarm § alarm § Menus fMoptions 


Figure 9-13. Alarm Log view. 


Display Global History 


Ack 


18 Stop 
monitor 


Displays a history of activity for the entire network at intervals you determine. 


Options 
Numeric 


Graphic 


Displays history statistics as columns of numbers. 


Displays the usage of the network in a graph. 
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Global History Statistics in Numeric Format 


Figure 9-14 is an example of the Global History Statistics view. 


The leftmost column of numbers identifies the interval number, with the most 
recently recorded interval at the top of the screen. 


The following list explains the fields in the numeric Global History Statistics 


view: 

Time Date and time of each interval. The date is not displayed 
if it is the same as the one above it. 

Frames Number of frames recorded for each interval. 

Errs Number of soft error report frames recorded for each 
interval. 

Bytes Number of bytes recorded for each interval. 

Size Average size of the frames recorded for each interval. 

% Usage Absolute network usage (in percentage) for each interval. 


LOBAL HISTORY STATISTICS-——————————_—_ctt 26 16:36:53 
Time Frames | Bytes Size Usage 


21 Oct 26 16:36:43 17,468 4,933,489 259 7.75 

g 16:34:43 28,984 7,229,993 249 12.38 
16:32:43 24,326 9,747,665 236 9.86 
16:30:43 22,886 5,748,709 258 9.83 
16:28:43 24,973 6,687,986 267 11.43 
16:26:43 25, 069 6,382,022 254 18.92 
16:24:43 26,788 6,487,011 239 18.99 
16:22:43 25, 863 6,571,694 262 11.24 
16:28:43 25,359 6,285,828 244 18.63 
16:18:43 24,168 6,148,575 254 18.51 
16:16:43 26,289 6,781,064 257 11.68 
16:14:43 26, 366 6,715,119 254 11.49 
16:12:43 26,969 6,152,979 228 18.56 
16:18:43 26, 891 6,911,299 249 11.15 
16:88: 43 22,652 9,013,472 243 9.450 
16:86:43 26,378 6,995,404 258 11.38r 
16:04:43 24,485 6,895,834 248 18.446 
16:82:43 22,415 5,471,446 244 9.38) 


18 Stop 
monitor 


Figure 9-14. Global history statistics (numeric format). 


Global History Statistics in Graphic Format 
Figure 9-15 is an example of the graphic Global History Statistics view. | 


The graphic view contains the interval number, the time, and the network 
usage. The graph illustrates the percentages of network usage. 
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Display 


Time 


21 Oct 26 16:36:43 
20 16:34:43 
16:32:43 
16:38:43 
16:28:43 
16:26:43 
16:24:43 
16:22:43 
16:28:43 
16:18:43 
16:16:43 
16:14:43 
16:12:43 
16:18:43 
16:98:43 
16:86:43 
16:04:43 
16:02:43 


Figure 9-15. Global history statistics (graphic format). 


Display Station History 


Displays a history of activity for a selected station or address at intervals you 
determine. The title identifies the station as well as whether statistics represent 
transmissions, receptions, or both, and whether they show absolute or relative 
network usage. If you do not select a station, these statistics are collected for the 
default address (Broadcast). 


Options 


Numeric Displays station history statistics as columns of numbers. 


Graphic Displays station history statistics in a graph. 


Station History Statistics in Numeric Format 


Figure 9-16 is an example of the history statistics view for a station named “File 
Server” in numeric format. The statistics displayed in the view pertain to the 
traffic transmitted or received (or both) by the station, depending on the setting 
of the Class option in the Display menu. 


The leftmost column consists of the interval numbers, with the most recently 
recorded interval at the top of the column. 


Time Date and time of each interval. 
Frames Number of frames recorded for each interval. 
Errs Number of errors recorded for each interval. 
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Bytes Number of bytes recorded for each interval. 

Size Average size of the frames recorded for each interval. 

% Usage Percentage of absolute or relative network usage for each 
interval. 


ABSOLUTE HISTORY STATISTICS TO AND FROM File Server-——————Oct 26 16:39:06 
Time Frames Errs Bytes Size Usage 


931,393 243 
2,962,108 281 
4,437,814 262 
3,201,848 224 
3,452,364 259 
4,179,546 287 
3,939,038 268 
3,772,781 240 
3,987,243 273 
3,778,333 259 
3,814,111 268 
4,395,063 285 
4,036,815 266 
3,773,153 246 
3,941,129 258 
3,478,488 263 
4,070,686 266 
3,718,778 259 


22 Oct 26 16:38:43 3,825 
21 16:36:43 18,513 
16:34:43 16,919 
16:32:43 14,263 
16:30:43 13, 286 
16:28:43 14,555 
16:26:43 14,674 
16:24:43 15,689 
16:22:43 14,594 
16:20:43 14,588 
16:18:43 14,238 
16:16:43 15,392 
16:14:43 15,524 
16:12:43 15,719 
16:18:43 15,254 
16:88:43 13,172 
16:06: 43 15,284 
16:84:43 14,325 


3 Views4d Views 6Disply 
earlier laterfj Menus fMfoptions monitor 


Figure 9-16. Station history statistics (numeric format). 
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Station History Statistics in Graphic Format 


Figure 9-17 is an example of the station history view for a station named “File 
Server’ in graphic format. 


The leftmost column consists of the interval numbers, with the most recently 
recorded interval at the top of the column. 


Time Date and time of each interval. 


% Usage Percentage of absolute or relative network usage for each 
| interval. The graph illustrates the percentages. 
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Alarm 


Options 


Alarm 


ABSOLUTE HISTORY STATISTICS TO AND al File Pg. ag rn 26 16:39:54 
®U 2 


22 Oct 26 
21 


Time 


16:38:43 
16:36:43 
16:34:43 
16:32:43 
16:30:43 
16:28:43 
16:26:43 
16:24:43 
16:22:43 
16:28:43 
16:18:43 
16:16:43 
16:14:43 
16:12:43 
16:19:43 
16:08:43 
16:26:43 
16:04:43 
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monitor 


Figure 9-17. History statistics for “File Server” (graphic format). 


Clears alarms from the alarm buffer automatically, sets alarm thresholds, and 
determines where to send the alarm log. 


Edit 


Global Alarms 


Displays the Manage Station Information view, in which 
you can edit station information. For further information 
on station information, refer to “Manage Stations” on 


page 9-36. 


Determines the types of network events that cause global 
alarms. For all options except Unknown station, 
Oversized frame, and Active Poll fail, you can set a 
threshold and define an interval (5 seconds to 60 minutes) 
to which the threshold applies. After each interval, the 
count resets to 0. The priority level of each Global alarm 
can be individually set. Options for Global alarms are: 


Unknown station triggers an alarm when an unnamed 
station transmits a frame. 


Oversized frame generates an alarm when a station sends 
a frame that exceeds 1,514 bytes. There is no threshold 
setting for this error. 


Broadcast storm defines the number of broadcast frames 
(1 to 65,535) that triggers an alarm. You can set the time 
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Station defaults 


interval to which this threshold applies (5 seconds to 60 
minutes). By default, the number of broadcast frames is 
100 and the interval is 5 seconds. 


Network idle defines the length of time (5 seconds to 60 
minutes) the network can be inactive before generating an 
alarm. By default, the length of time is 15 minutes. 


Network usage defines the percentage (1 to 100%) of 
absolute network usage that triggers an alarm. You can 
set the time interval to which this threshold applies (5 
seconds to 60 minutes). By default, the percentage is 50 
and the interval is 5 seconds. 


Soft errors defines the number (1 to 65,535) of soft error 
report frames that triggers an alarm. You can set the time 
interval to which this threshold applies (5 seconds to 60 
minutes). By default, the number of errors is 20 and the 
interval is 30 seconds. 


Ring beaconing defines the length of time (5 seconds to 
60 minutes) the ring can beacon before generating an 
alarm. By default, the length of time is 30 seconds. 


Active Poll fail generates an alarm if there is a ring poll 
failure. There is no threshold setting for this error. 


assigns the default threshold settings to new stations as 
they are detected on the network. The thresholds are 
described below: 


Errors defines the number (1 to 65,535) of soft error 
frames a station can transmit before triggering an alarm. 
The default number is 100. 


No response determines when the monitor generates a 
no-response alarm. The default setting of No response is 
Off. The monitor does not generate a no-response alarm | 
each time the specified number of seconds has elapsed 
since a station received a frame. Instead, it makes sure 
that the station it generates the alarm for has been 
receiving but not transmitting. For example, if No 
response is 5 seconds, the monitor generates the alarm 
when either of the following conditions occurs: 


¢ A station’s last reception happened at least 5 seconds 
after the last transmission, and it has received 3 frames 
since the last transmission. 


¢ A station’s last reception happened at least 5 seconds 
after the last transmission, and 5 seconds have elapsed 
since the last reception. 


Idle defines the length of time (1 to 120 minutes) the 
station can go without transmitting before triggering an 
alarm. The default setting is Off. That is, the monitor does 


Report 


Options 


Auto clear 


Log to 


Report 


not generate an alarm regardless of how long a station has 
been idle. 


Usage defines the percentage of relative network traffic (1 
to 100%) the station can generate before triggering an 
alarm. The default setting is Off. 


Priority defines the importance of alarms for a given 
station. The priority levels are Inform, Warning, Minor, 
Major, and Critical. The default value is Warning. 


Sets an interval (1 minute to 99 hours) at which the 
monitor automatically clears each alarm to make room in 
the alarm buffer. To make sure alarms are not lost, use 
Log to for printing out the alarms or storing to disk. To 
turn Auto clear off, choose 0. The default value is 1 hour. 
The monitor can clear alarms automatically only when it 
runs in the foreground. 


Specifies where to send the alarm log. You can select 
either or both of the following: 


¢ Printer, which sends the alarm log to the specified 
printer. 


Select the appropriate device in the Alarm \Log 
to\Printer menu to print on the printer port (COMI, 
COMz2, LPT1, LPT2, LPT3, or LPT4). Specify the 
number of lines (0 to 256) on each page with the Page 
size option. If you specify 0, no page break is inserted. 
The default page size is 58. 


* File, which sends the alarm log to a disk file 
(ALARM.LOG). 


The Clear alarm file option in the Alarm \Log to\File 
menu determines whether the monitor appends the 
current alarm log to the previous log file or clears the 
log file each time it starts monitoring. A preceding V 
mark indicates that the file is cleared at the beginning 
of each monitoring session. 


Generates reports based on report scripts. You can print the resulting reports 
and save them as files, in either standard or CSV (comma-separated values) 
format. The Report Script Editor view lets you modify report scripts to 
customize reports to your needs. 


Load 


Loads an existing report script which you can use to 
generate a report or edit before generating a report. (The 
monitor looks for report scripts in the 
C:\TRREPORT\SCRIPTS directory.) 
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The monitor comes with the following report scripts: 


ERRORS.SCR provides statistics for the 10 stations that 
transmitted the most frames with errors during the most 
recent monitoring session. A station must have 
transmitted at least five frames with errors to be included 
in the report. 


FRAMSIZE.SCR shows the frame size distribution. The 
statistics provided include the number and percentage of 
frames that fall in each frame size category. A graph 
illustrates the percentages. 


HISTORY.SCR shows the absolute network usage in 
percentages for all the history intervals. 


LISTENRS.SCR provides statistics for the 10 stations that 
received the most traffic during the most recent 
monitoring session. 


RINGORDR.SCR provides statistics for the relative usage 
of the network by all stations. The stations are sorted by 
ring order. For further information on ring order, refer to 
“Display All Stations” earlier in this chapter. 


ROUTELEN.SCR provides statistics for different route 
lengths. The report shows the number and percentage of 
frames of each route length. The information in the report 
is the same as the Route Lengths view. 


ROUTEPTH.SCR provides statistics for route path 
distribution. The report shows the number and 
percentage of frames for each type of route path. In the 
display, “Loc” represents local; “Rem” represents remote; 
and “Other” represents other routes. For further 
information on route paths, refer to “Display Routing 
Info” earlier in this chapter. | 


SAPS.SCR provides statistics for the SAP protocol type 
distribution. The report shows the number of bytes that 
belong to each SAP protocol type and the percentage of 
network usage by these bytes. 


TALKERS.SCR provides statistics for the 10 stations that 
transmitted the most traffic during the most recent _ 
monitoring session. 


USERLIST.SCR lists the physical addresses and names of 
all stations, sorted in descending order by name. 


USERS.SCR provides transmit and receive statistics for all 
stations, sorted in ascending order by name. 


USERSCSV.SCR provide the same information as the 
USERS report, but in a delimited format that allows you 
to import the information into spreadsheets and other 
applications. 
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Edit 


Report 


(For more information on these reports, see “Sample 
Reports: An Overview” on page 6-3.) 


Displays the Report Script Editor view, which contains 
the last report script loaded and the function keys with 
which you modify the script. Refer to “Report Script 
Editor View” on page 9-35 for further information on 
how to use the function keys. 


The Edit option also specifies how the statistics are sorted 
and what statistics are to be included in an existing report 
script. 


The following are the various options by which a report 
sorts the statistics: 


To refers to the frames the station receives. 
From refers to the frames the station sends. 
Both refers to the frames the station sends and receives. 


Note: The To, From, and Both options determine the type 
of traffic to which the sort key applies. Therefore, they do 
not affect how a report orders the stations if it sorts them 
by name or address. These options, however, determine 
whether a station is considered active. Refer to the 
description for Active stns only later in this section for 
information on including only active stations in a report. 


Ascending specifies that the stations be displayed in 
ascending order. 


Descending specifies that the stations be displayed in 
descending order. 


Name is the station’s name. 


Partner's name is the name of the station’s partner. A 
station’s partner is the station that it communicated with 
most recently. 


Ring order is the order the stations are inserted in the 
network. Refer to “Display All Stations” on page 9-15 for 
information on ring order. 


Frames is the total number of frames. 

Errors is the total number of soft error frames. 
Bytes is the total number of bytes. 

Average size is the average frame size. 


Network usage is the percentage of network usage by the 
station. 


First activity is the time when the station first sends or 
receives traffic. 
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Last activity is the time when the station last sends or 
receives traffic. 


Elapsed activity is the amount of time between the first 
and last activity. 


Address is the station’s address. 


The following describes the options that determine what 
types of statistics are to be included in a report: 


Active stns only specifies that a station is included ina 
report only if it has sent or received a frame, depending 
on how the stations are sorted. For example, if they are 
sorted by the frames received (when the To option in the 
Report \Edit\Sort by menu is selected), a station is 
considered active if it has received traffic. 


Inserted stns only specifies that a station is included ina 
report only if it is connected to the local network. That is, 
the station status of the station must be active monitor, 
standby monitor, or snooper. 


Delimited format specifies that the report is in 
spreadsheet-compatible format. A report in this format 
does not include embedded commas in numbers. Also, 
when you print out the report, the monitor does not insert 
any page breaks. 


Filter 1 and Filter 2 determine whether the monitor uses 
filters to exclude stations from a report if they do not meet 
certain criteria. How the filters interact with each other 
depends on the AND and OR options. If AND is selected, 
the monitor includes only the stations fulfilling the 
requirements of both filters; if OR is selected, it includes 
the stations that meet the requirements defined by either 
filter. 


For examples that illustrate the filters’ interaction, refer to 
“Creating or Modifying a Report Script” on page 6-20 
and “Recommendations on Report Editing” on page 6-25. 


The To, From, and Both options associated with the filters 
determine whether the monitor filters out stations from a 
report based on the traffic received, sent, or both, 
respectively. These options do not take effect if the 
stations are filtered by sort position, name, partner's 
name, or address. 


Other options associated with the filters are described 
below. Each option defines a range of values. 


Sort position is the position of the station in the report. 
The permissible range is 1 through 1,024. For example, if 
you specify that the minimum is 1 and maximum is 20, 
the top 20 stations are included in the report. 


Report 


Name is the station’s name. It specifies the alphabetical 
range to which the station’s name must belong if the 
station is to be included in the report. The minimum value 
is “” and the maximum is “~~~~~~~~~~~~~~~~ ”, That 
is, the minimum or maximum value can be up to 16 
characters. For example, you can define “bb” as the 
minimum value and “kk” as the maximum. If a station’s 
name is bobby, it fulfills the requirement of the filter. If a 
station’s name is kristen, it is outside the specified range 
and the station will not be included in the report. 
Numerals are considered smaller than letters. For 
example, you can define the minimum to be “123” and 
maximum to be “abc.” The sorting of the name strings is 
not case-sensitive. 


Partner's name is the name of the station with which a 
station communicated most recently. For a station to be 
included in the report, its partner’s name must belong to 
‘the alphabetical range defined by Partner’s name. The 
rules for specifying the range are the same as those for 
Name. 


Frames is the total number of frames. The permissible 
range is 0 through 4,294,967,295. 


Errors is the number of soft error report frames. The 
permissible range is 0 through 65,535. 


Bytes is the number of bytes. The permissible range is 0 
through 999,999,999,999. 


Average size is the average frame size. The permissible 
range is 17 through 18,432. 


First activity is the date and time when the first activity 
takes place. The minimum time is 0 days; the maximum 
time is 49 days 17:02:47.295. A station is included only if 
its first activity happened in the time period specified. For 
example, suppose the monitoring session started at 1 p.m. 
If you specify that the minimum value of First activity is 
2 hours, and that the maximum value is 7 hours, a station 
is included in the report only if its first activity happens 
between 3 p.m and 8 p.m. 


Last activity is the date and time when the last activity 
takes place. It has the same permissible range as First 
activity. 


Elapsed activity is the time between the first and last 
activity. It has the same permissible range as First 
activity. For example, if you set minimum value to 0 and 
maximum value to 2 days, only the stations whose first 
and last activities happened within 2 days meet the 
requirement of the filter. 
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Address is the station’s address. The permissible range is 
000000000000 through FFFFFFFFFFFF. 


Absolute usage is the percentage of absolute network 
usage by the station. The permissible range is 0 through 
100%. For example, if you specify minimum to be 10% 
and maximum 100%, only the stations whose traffic 
accounts for at least 10% of the network capacity meet the 
requirement of the filter. 


Relative usage is the percentage of relative network 
usage by the station. The permissible range is 0 through 
100%. For example, if you specify minimum to be 10% 
and maximum 100 percent, only the stations whose traffic 
accounts for at least 10% of the network traffic meet the 
requirement of the filter. 


Save Saves a report script you created or modified. The report 
script must be stored in the C:\TRREPORT\SCRIPTS 
directory. 

Clear Erases the contents of the report editor. 

Print Prints the report based on the report script that has been 
loaded. 


The Screen option displays the report on the screen. 


The Device option is the printer port. You can choose 
between COM1, COM2, LPT1, LPT2, LPT3, or LPT4. If 
you send the report to a printer, you can specify the 
number of lines per page. The default is 58. 


The File option saves the report to disk under a filename 
of your choice. The monitor attaches the extension .RPT 
or .CSV (if the report is in delimited format) to the 
filename. 


The Page size option is applicable if Delimited format in 
the Report\Edit menu is disabled, and the report is 
printed to a file or device. It defines the number of lines 
printed before the monitor inserts a page break. The 
number ranges from 1 to 256. If you want no page breaks, 
set this option to 0. When the monitor inserts a page 
break, it also prints the header text in the report (for 
example, the report title). 


Auto print Prints out the report at each interval until midnight; 
restarts printing at the time specified by the Start time 
option. The monitor must be running in the foreground 
for Auto print to function. The following describes the 
options: 


Report specifies the file to be printed. 


Start time determines when the first report of each day is 
printed. For example, if Start time is set to 12:00, and the 
current time is 8 a.m., the monitor will print the first 


9-34 (Nesvort] 


Report Script Editor View 


Report 


report at noon. If the start time is already past (for 
example, it is set to 08:00 and the current time is 2 p.m.), 
the first report is printed at the next interval boundary, 
which is determined by the Interval option. For example, 
if Interval is 15 minutes, the first report is printed at 2:15 
p.m. To disable this function, specify 00:00. By default, 
Start time is disabled, which means that the first report is 
generated immediately. 


Interval determines how often the monitor prints a 
report. Specify a time between 1 minute and 24 hours. The 
default value is 1 hour. 


Print to device specifies the printer port the monitor uses 
to print out the file (either COM1, COM2, LPT1, LPT2, 
LPT3, or LPT4). You can specify the number of lines per 
page. The default is 58; selecting 0 disables page breaks. 
When the monitor produces a page break, it also prints 
the header text (for example, the title of the report). 


Print to disk specifies that the monitor print the report to 
a file in the C:\TRREPORT directory. If Single file is 
selected, all reports are appended to one file. The filename 
is ARYYMMDD.RPT (YYMMDD represents the year, 
month, and day). If Multiple files is selected, each report 
is printed to a separate file. The filename for each report 
is YYMMDDNN.RPT (NN represents the number of the 
report). You can print reports to up to 99 files. 


Restart monitor determines whether the monitor starts a 
new monitoring session once it printed out a report. 


By default, Print to device, Print to disk, Multiple files, 
and Restart monitor are not selected. 


The Report Script Editor view (invoked by Edit in the Report menu) lets you 
modify the last report script that was loaded. Its functions are accessible 
through special function keys. These keys are described below: 


F2 (Insert field) 


F3 (Insert line) 
F4 (Delete line) 


F6 (Edit options) 


Displays a list of fields you can include in the report. 
When you select a field, the monitor inserts a code into the 
script. Whenever you preview, print, or save a report | 
based on this script, the monitor inserts the current 
statistics that the code represents. Appendix B provides 
information on the report fields. 


Inserts a blank line into the report script. 


Deletes the line that contains the cursor from the report 
script. 


Provides the Load, Save, Clear, Print, and Auto print 
options. These options are also available when you select 
Report from the Main Menu. 
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In addition, the Report settings option specifies how the 
statistics are sorted, whether only active stations are 
included, whether only inserted stations are included, 
and how the filters are used. Report settings presents the 
same menu as the Report\Edit menu. 


F7 (Chars) Lists the special characters you can insert in a report 
script. 

F8 (Repeat char) Repeats special characters for continuous lines or borders. 

F9 (Screen test) Provides a preview of the current report on screen. 


Manage Stations 


Displays and edits station information such as station names and threshold 
settings. 


Options 
Edit Displays the Manage Station Information view. This view 
is also generated by Edit in the Alarm menu. Refer to the 
“Manage Station Information View” section for further 
information on the view. 


Reset thresholds __ Resets all station alarm thresholds to the default settings 
specified by the current station default thresholds. 


Probe for names Tries to assign names automatically using the NetBIOS 
remote status command. This option operates only when 
you have installed a second network interface card with 
the NetBIOS software. A station responds only if it is 
active and running the NetBIOS software. 


Manage Station Information View 
Figure 9-18 is an example of the Manage Station Information view. 


To edit a station’s information, use the cursor to highlight the corresponding 
entry. You can also type the first letter of the station’s name to move to the entry. 
Press Enter, and a dialog box appears, which allows you to change the following 
types of information: 


Name The station name assigned to an address. The name can © 
contain up to 16 printable ASCII characters. 


Errors The number of soft error frames (1 to 65535) a station can 
transmit before triggering an alarm. 


No response How long a station can be sent frames (broadcast frames 
excluded) without responding before triggering an alarm. 
Any value from 1 to 7 seconds is allowed. 


Idle The length of time (1 to 120 minutes) the station can go 
without transmitting before triggering an alarm. 
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% Usage The percentage of network traffic (1 to 100%) the station 
can generate before triggering an alarm. 


Priority The importance of a station’s alarms. The levels are 
Inform, Warning, Minor, Major, or Critical. 


Alternatively, you can use the function keys to edit the station information as 
described below: 


F2 (Delete station) | Removes the station from the monitor data files. 


F4 (Apply default) Changes the threshold settings to the defaults. Specify the 
defaults with Alarm in the Main Menu. Refer to “Alarms” 
earlier in this chapter for further information on setting 
station default threshold settings. 


F7 (Thres options) Displays the threshold options, which are the same 
options displayed by the Thresholds options in the 
Alarm menu. 
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Figure 9-18. Manage Station Information view. 
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Options 
Allows you to set the network monitoring speed and audible alarms. 


Audible alarms You can set the audible alarms on or off. When set on, a 
different audible alarm (beep) is generated for each level 
of alarm you select (Inform, Warning, Minor, Major, and 
Critical). When set off, no audible alarm is generated. 


4Mbps/16Mbps /Youcan modify the network interface card’s monitoring 
speed, which is either 4 Mb/s or 16 Mb/s. To change the 
transmit speed, you must change the setting on the 
network interface card. For further information on setting 
the transmit speed, refer to the Sniffer Network Analyzer: 
Installation Guide. 


Exit 
Terminates the monitor's user interface and displays the Main Selection Menu. 


Although you can continue to monitor in the background after you terminate 
the monitor’s user interface, you cannot log alarms, clear the alarm log, or print 
reports automatically. 


Upon exit, the monitor writes the STARTUP.TRB file. 
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Appendix A. Error and Warning Messages 


This appendix lists the monitor’s error and warning messages alphabetically. It 
explains each message and describes the action you should take when the 
message appears. 


Monitor Error Messages 


Error Message Description 
An error was encountered while Appears when you try to load an invalid report script 
loading the report script. file. Check your script and reload. 
Automatic report generation aborted. Appears when the user hits the Escape key while a 


report is being auto-printed. 


Automatic report generation failed. Appears when the monitor tries to print a report 
automatically but the report script is corrupted. Check 
the report script file, edit it if necessary, and load it 
before you regenerate the report. 


Automatic report generation failed. Appears when the monitor tries to print a report 
Couldn't open report file. automatically but there are problems with the 
) destination disk (for example, the directory structure is 
damaged). Make sure that your disk is operating 
properly and that the report scripts are stored under the 
C:\TRREPORT\SCRIPTS directory. 


Automatic report generation failed. Appears when the report to be printed is sorted by ring 

Couldn't sort stations. order but the monitor cannot determine the ring order. 
This happens when the actual number of stations on the 
network exceeds 1,024. 


Automatic report generation failed. Appears when the monitor tries to print a report 

Disk full. automatically to the disk but the disk is full. Remove 
unnecessary files from the disk to make room for the 
reports. 

Automatic report generation failed. Appears when the monitor tries to print a report 

Report script not found. automatically but cannot find the report script that the 


report should be based on. Check to be sure that the 
script is stored in the C:\TRREPORT\SCRIPTS directory. 


Automatic report generation failed to Appears if the monitor fails to restart monitoring after 

restart monitoring. generating a report automatically. Check to see whether 
the hardware configuration is correct. If the monitor still 
cannot start monitoring, contact NGC for help. 
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Error Message 


Automatic report generation failed to 
restore report script. 


Can’t concatenate fields. 


Couldn't generate a NetWare echo test. 


Couldn't open file. 


Couldn’t save station information. 


Fatal Error: Unable to load the monitor 
configurator! If the problem persists, 
contact Technical Support. 


Fatal Error: Unable to load the monitor 
demo! Reboot the system and configure 
the monitor again. If the problem 
persists, contact Technical Support. 


Fatal Error: Unable to determine the 
monitor state! Reboot the system and 
configure the monitor again. If the 
problem persists, contact Technical 
Support. 


Fatal Error: Unable to load the monitor. 
Reboot the system and configure the 
monitor again. If the problem persists, 
contact Technical Support. 


Fatal Error: Unable to load the monitor 
driver. Reboot the system and 
configure the monitor again. If the 
problem persists, contact Technical 
Support. 
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Description 


Appears if the monitor cannot restore the report script 
after generating a report automatically. The changes that 
you have made to the script with the script editor are 
lost. Contact NGC for help if this happens. 


Appears in the Report Script Editor view if you try to 
place two fields on the same line without any text 
characters between them. Place at least one text character 
between any two fields. 


Appears when the monitor cannot communicate with 
the NetWare stack installed on the network interface 
card. Contact NGC for help if this happens. 


Usually indicates that you typed the file name 
incorrectly. Try typing the name again. If you cannot 
open any files, check the FILES= setting in the DOS file, 
CONFIG.SYS. Increase the number, and reboot. 


Appears if the disk is full. Make room by deleting other 
files that may not be essential, such as old history logs. 


Appears when the Sniffer Network Analyzer fails to load 
the monitor configurator. Reboot and try again. If the 
message appears again, contact Technical Support. 


Appears when the Sniffer Network Analyzer fails to load 
the monitor demo. Reboot and try again. If the message 
appears again, contact Technical Support. 


Appears when the Sniffer Network Analyzer fails to 
determine the state of the monitor. Reboot and contact 
Technical Support if the same message appears the next 
time you try to start the monitor. 


Appears when you attempt to start the monitor but the 
necessary files are not loaded into memory. Reboot and 
try again. If the message appears again, contact Technical 
Support. 


Appears when you attempt to start the monitor but the 
necessary files are not loaded into memory. Reboot and 
try again. If the message appears again, contact 
Technical Support. 


Error Message 


Fatal Error: Unable to unload the 
monitor from memory. Reboot the 
system and configure the monitor 
again. If the problem persists, contact 
Technical Support. 


Field too long. 


Help file not found. 


Network card not responding. 


No alarms to process. 


No Receive Signal detected. Make sure 
that you entered the ring at the correct 
speed. 


No report script disk files found. 


No statistics have been collected. 


Not a valid DOS file name. 


Not enough memory to run test. 


Sorting by errors with the Class option 
set to “To” is invalid. Press F6 to select 
a different sort option, or press F5 for 
the Main Menu. 


The broadcast address cannot be 
deleted. 


Monitor Error Messages 


Description 


Appears when the Sniffer Network Analyzer fails to 
remove the monitor driver from memory. Reboot and 
contact Technical Support if the same message appears 
again. 


Appears in the Report Script Editor view when the end 
of the field you want to include reaches past the end of a 
line (column 80). Try positioning the cursor farther to the 
left before placing the field. 


The monitor could not find the TRMON.HLFP file in the 
C:\TRSNIFF directory. Restore this file from your back- 
up disk. 


Indicates a problem with programming the network 
interface card. Contact NGC for help. 


Appears if you try to acknowledge or clear an alarm in 
the Alarm Log view when there are no alarms in the 
alarm buffer. 


Appears when the monitor detects a cable or ring speed 
problem while a new monitoring session is being started. 


Appears if you try to load report scripts and the monitor 
cannot find any report script files. Restore the report 
scripts from your back-up disk. 


Appears when you try to display statistics but you have 
not started a monitoring session. Start a monitoring 
session by pressing F10 (New monitor). 


Appears when you try to enter a filename that contains 
invalid DOS characters. Try typing the name again, 
following the DOS filename requirements. 


Appears when you try to run the NetBIOS station test 
function and there is no memory available to allocate the 
NetBIOS statistics structure. Try decreasing the number 
of history intervals or maximum stations. 


Appears if you try to sort the stations in the All stations 
view by the number of errors transmitted while the 
setting of the Class option is To. “Errors” is an invalid 
sort key because soft error frames are received by the 
error monitor only. 


Appears if you try to delete the broadcast address. 
Reselect the station you want to delete. 


As 
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Error Message 


The current report script contains no 
information. Use the Report Editor to 
create a report, or load a report from a 
disk file. 


The minimum filter value must be less 
than or equal to the maximum filter 
value. 


The STARTUP.TRI file has too many 
entries. The entries at the end of the 
file were not loaded. 


The STARTUP.TRT file has been 
changed. You must unload 
TRMONDRV.EXE for the changes to 
take effect. 


The STARTUP.TRT file has too many 
entries. The entries at the end of the 
file were not loaded. 


The STARTUP.TRT file has too many 
group entries. The entries at the end of 
the file were not loaded. 


The value you have entered is not valid 
for this item. 


This is not a Network General network 
card. What you are doing is illegal! 


This software has been tampered with. 
What you have done is illegal! 


Unable to print alarm log, check 
printer. 


Write to alarm log failed. Disk full. 


Write to file failed. Disk full. 
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Description 


Appears if you try to print or save a report without first 
loading or editing a report script. Load the desired 
report script or create a report script, then try again. 


Appears if you try to enter a minimum value for a report 
filter that exceeds the maximum value. Enter a minimum 
filter value that is less than or equal to the maximum 
filter value. 


Appears if STARTUP.TRI contains more than 225 
entries. 


Appears if you have used a text editor to modify 
STARTUP.TRT when TRMONDRYV is loaded. In order 
for the monitor to use consistent SAP information, you 
must remove TRMONDRV from memory before 
changing STARTUP.TRT. Then restart the monitor. 


Appears when STARTUP.TRT contains more than 32 
SAP entries or 32 Ethertype entries. 


Appears when STARTUP.TRT contains more than 16 
SAP labels or 16 Ethertype labels. 


Appears when you enter an invalid value. Most 
messages tell you the range of valid values; if not, try 
entering a lower or higher value. 


Appears if you use the monitor software with a network 
interface card other than that supplied by NGC. 


Your software has been illegally modified and 
executable files were corrupted. Call NGC for help. 


Appears when you try to print the alarm log and the 
printer does not respond. Make sure the printer is 
connected to a printer port and that it is turned on and 
functioning properly. 


Appears if the disk is full when the monitor tries to add 
alarms to the alarm log on the disk. Make room by 
deleting other files that are not essential, such as files 
containing history statistics that you no longer need. 


Appears if the disk is full when you try to store a report 
to the disk. Make room by deleting other files that may 
not be essential, such as files containing history statistics 
that you no longer need. 


Error Message 


Write to history log failed. Disk full. 
You did not enter a file name. 


You must load a NetWare shell before 
you can use this feature. 


You must load a NetBIOS handler 
before you can use this feature. 


You must specify a unique station. 


You must stop monitoring before you 
can use this feature. 


You should not include a file 
extension. 


Monitor Warning Messages 


Monitor Warning Messages 


Description 


Appears if the disk is full when the monitor tries to store 
the history log to the disk. Remove unnecessary files 
from the disk to make room for the history log. 


Appears if you try to store a report to the disk but have 
not specified the filename. 


Appears if the monitor tries to perform a station test but 
no network interface cards are loaded with NetWare. 
Check to make sure that more than one network card is 
installed, and that one of the network cards is using 
NetWare. 


Appears if you try to use Station test with the NetBIOS 
or Probe for Names option and the monitor cannot find 
the NetBIOS software. If you are sure that you are 
running NetBIOS, press Enter to ignore the message. If 
you cannot proceed, contact NGC for help. 


Appears if you try to send a test frame with either a 
broadcast or multicast address as the destination 
address. Select an individual station as the destination 
address of a test frame. 


Appears if you try to start a transmit timer or station test 
when a monitoring session is in progress. Press F10 to 
stop the monitoring session before starting these monitor 
functions. 


Appears if you include a file extension when you specify 
a name of a file to which a report is stored. 


The following is an alphabetical listing of warning messages that appear during 
normal operation. They provide a brief explanation of the consequences of 
proceeding and give you a chance to change your mind. 


Warning Message 


Any changes made to station alarm 
configurations will be lost if you 
proceed. 


File exists. 


Description 


Appears after you change threshold settings and then try 
to reset all thresholds to the default settings. 


Appears when you try to assign a report script filename 
that already exists. Unless you assign a different 
filename, the new report script overwrites the existing 
script. 
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Warning Message 


No Receive Signal detected. Make sure 
that you entered the ring at the correct 
speed. 


The current history statistics will be 
cleared if this setting is updated. 


The last line of the report script will be 
lost if this line is inserted. Press 


ENTER to proceed. Press ESC to cancel. 


The number of stations being 
monitored has reached the maximum 
value set in the configuration program. 
You should increase this setting to 
make sure that all stations are being 
monitored. 


The number of stations being 
monitored has reached the Sniffer 
Network Monitor’s maximum value. 


The Sniffer Network Monitor will stop 
monitoring if you proceed. Press 


ENTER to proceed. Press ESC to cancel. 


These changes will not be saved unless 
you enter a name for the station. 


This selection will not take effect until 
the next time the collection of history 
statistics starts. | 


The Sniffer Network Monitor has been 
monitoring for more than 5 weeks. You 
must start a new monitoring session or 
the statistics will overflow. 


You have not saved the latest Report 
Editor session. Any changes will be 
lost if you proceed. 


You must stop monitoring before you 
can change this filter. 
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Description 


Appears if the monitor enters the Token-Ring network at 
the wrong speed or if it is the only station on the ring. If 
the wrong speed has been set, stop the monitor, reset the 
speed on the network card, and restart the monitor. 


Appears when you try to change either the station for 
which history statistics are collected or the history 
interval during a monitoring session. To prevent losing 
the statistics, print a report before changing these 
settings. 


Appears if you try to create or modify a report script to 
contain more than 58 lines. 


Appears when the actual number of stations on the 
network exceeds the value of Maximum Stations in the 
Configuration Options view. The message appears when 
you use the Display command on the Main Menu. 


Appears when more than 1,024 stations are on the 
network; 1,024 is the maximum number of stations that 
the monitor can monitor. 


Appears after you pressed F10 during a monitoring 
session. To stop monitoring, press Enter. If you want the 
monitoring session to continue, press Esc. 


Appears if you try to save alarm thresholds for a station 
that is not named. Since the monitor considers unnamed 
stations as intruders, you must name all legal stations. 


Appears if you change the Align history option under 
History. The new setting takes effect at the next 
monitoring session. 


Indicates that the statistics accumulated may not be 
accurate due to overflow. You should start a new 
monitoring session. 


Appears if you try to exit the monitor’s Main Menu 
without saving the latest report script you edited. 


Appears if you try to change the option settings for 
Monitor filter when a monitoring session is in progress. 
Press F10 to stop monitoring before you change the 
options. 
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General 


Appendix B. Report Fields 


Overview 


Global Fields — 


This appendix explains the meaning of each field that you can insert or edit in a 
report script. It also gives the code that represents each field. On the screen, the 
actual code is preceded and followed by the “at” sign (@). 


To display the list of report fields as shown in Figure B—1, press F2 (Insert field) 
in a Report Script Editor view. This appendix describes the fields in the same 
order as they appear in Figure B-1. To find out what a particular code in your 
report script stands for, refer to the list of codes at the end of this appendix. 


FF TELDS=== 
Global 


Stations State 


Station From 


Errors 


To Both 


Sort Pos Partner Partner Partner 


% Usage Oversize Address % Usage % Usage % Usage 


Frames Purges Name Frames 
Bytes  Softkrrs Status Errors 
Avg Size Hist Stn Bytes 
First Text 
Last CSV Ret First 
Elapsed Last 
History 
Start 
End 
Active 
CurrTime 
FrmSizes 
Routing 
SAPs 


History 


Etypes 


Figure B-1. Report fields. 


Frames 


Bytes 
Avg Size Avg Size Avg Size 
First First 
Last Last 
Elapsed Elapsed Elapsed 
History History 


Frames 
Errors 
Bytes 


The fields under the heading “Global” represent information about the entire 
network. The following list explains the meanings of the Global fields: 


Stations 


Number of stations. It has three options: 


Total Stations is the number of all the stations that have 
transmitted in the current monitoring session. The code is GS. 


Maximum Inserted Stns is the maximum number of stations at 
one time in the current monitoring session, whose station 
status is active monitor, standby monitor, or snooper. The code 


is GMI. 
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% Usage 


Frames 
Bytes 
Avg Size 
First 


Last 


Elapsed 


History 


Start 


End 


Active 


CurrTime 


FrmSizes 


Routing 


Current Inserted Stns is the number of stations whose station 
status is active monitor, standby monitor, or snooper at the 
time the report is generated. The code is GCI. 


Absolute network usage. It has two options: 


Numeric displays the percentages in numbers (without the 
percent sign). The code is GUAB. 


Graphic displays the percentages in a graph. You can select the 
scale used on the axis, which can be 0.4, 2, 10, 20, 50, or 100%. 
The code is GUSAGE ABS, which is followed by the scale. 


Total number of frames. The code is GFRAME. 
Total number of bytes. The code is GBYTE. 


Average size of the frames in the current monitoring session 
(total number of bytes divided by the total number of frames). 
The code is GAV. 


Time when the first network activity took place. The code is 
GFIRST. 


Time when the last network activity took place. The code is 
GLAST. 


Time elapsed between the first and last network activity. It 
shows the number of days, hours, minutes, and seconds. The 
code is GELAPSED. 


Global history statistics. It has two options: 


Numeric shows the history statistics in the same format as the 
numeric Global History view. The code is GHISTORY 
NUMERIC ABS. 


Graphic shows the history statistics in the same format as the 
graphic Global History view. You can choose the scale used on 
the axis, which can be 0.4, 2, 10, 20, 50, or 100%. The code is 
GHISTORY GRAPHIC ABS. : 


Time the monitoring session started. The code is GMON 
START. 


Time the monitoring session stopped. If a monitoring session is 
in progress when the report is generated, the current time is 
printed. The code is GMON END. 


Duration of the monitoring session. The code is GMON 
ACTIVE. 


Current time. The code is GCURRENT TIME. 


Distribution of the frame sizes. It displays the number of 
frames that fall in each size category. The format is the same as 
the Frame Sizes view. The code is GFRAME SIZES. 


Routing information. It has two options: 


SAPs 


Etypes 


Global Fields 


Paths shows the distribution of frames according to path 
categories. The categories are listed below: 


Loc-to-Loc represents the frames that are originated from and 
destined for the local network. 


Loc-Rem represents the frames that are sent from the local 
network to a remote network. 


Rem-Loc represents the frames that are sent from a remote 
network to the local network. 


Rem-Rem represents the frames whose origin and destination 
are both on remote networks. 


Loc-Other represents the frames that are sent from the local 
network to a remote network that does not support source 
routing. 


Other-Loc represents the frames that are sent from a remote 
network that does not support source routing to the local 
network. 


The code is GROUTE.PATHS. 


Lengths shows the distribution of frames according to path 
length categories in the same format as the Routing Lengths 
view. The code is GROUTE.LENGTH. 


Distribution of traffic according to SAP types. The format is the 
same as the Protocol Types (SAPs) view. It has two options: 


Bytes shows the number of bytes for each SAP type. The code 
is GSAPS.BYTES. 


Frames shows the number of frames for each SAP type. The 
code is GSAPS.FRAMES. 


Distribution of traffic according to Ethertypes. The format is 
the same as the Protocol Types (ETHERTYPES) view. It has two 
sets of options: 


Bytes or Frames shows the number of bytes or frames for each 
Ethertype. 


All Frames or SNAP ONLY bases the percentages shown on 
either the total number of frames counted or on only the SNAP 
frames counted. 


The codes differ for each combination: 


For Bytes and All Frames — 
GETHERTYPES.BYTES.ALL.FRAMES 


For Bytes and SNAP ONLY — 
GETHERTYPES.BYTES.SNAP.ONLY 


For Frames and All Frames — 
GETHERTYPES.FRAMES.ALL.FRAMES 


For Frames and SNAP ONLY — 
GETHERTYPES.FRAMES.SNAP.ONLY 
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Error Fields 


The fields under the heading “Errors” represent different types of errors on the 
network, which are the same as the ones displayed in the lower-left portion of 
the numeric Global Statistics view. The following list explains the meanings of 


the Error fields: 
State 

Oversize 
Purges 
SoftErrs 


Station Fields 


Overall condition of the network. The code is ESTATE. 
Number of oversize frames. The code is EOV. 
Number of ring purges. The code is EPU. 


Number of soft errors. The code is ESO. 


The fields under the heading “Station” represent station information. The 
following list explains the meanings of the Station fields: 


Sort Pos 
Address 
Name 
Status 
Hist Stn 


Text 


CSV Ret 
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Sort position of the station. The code is SS. 
Station address. The code is SADDRESS. 
Station name. The code is SNAME. 
Station status. The code is SSTATUS. 


Name of station for which the monitor collects history 
statistics. The code is SHISTORY STN. 


Text characters. If you want to have characters separating two 
entries in the report, position the cursor below the line that 
represents an entry in the script, type the character and insert 
Text. The character is printed below each entry in the generated 
report, and is replicated four times. For example, if you want to 
print ##### between each pair of entries in the generated 
report, type # and select Text. The character and the code 
appear in the report script as #@ST@. If no character precedes 
the field, the report assumes that character to be a blank, anda 
blank line appears in the generated report where you insert 
Text. 


Carriage return in a report script with CSV format. Use this 
field if the report contains lines that exceed the maximum 
width of the script (80 characters). The report suppresses a 
linefeed where you insert this field. For example, your report _ 
contains four fields, each of which has 30 characters. If you 
insert CSV Ret after the second field, the third and fourth fields 
are printed on the same line as the first two in the generated 
report. Although the total length of the fields exceeds the width 
of the report script, they are interpreted as one entry when the 
report is imported into a spreadsheet program. The code is SC. 


From, To, and Both Fields 


From, To, and Both Fields 


The headings “From,” “To,” and “Both” represent the class of traffic. The fields 
under the headings “From” and “To” are related to traffic transmitted and 
received by each station in the report. The fields under the heading “Both” are 
related to the traffic both transmitted and received by the stations. The 
following list explains the meanings of the fields under these headings. The 
term “this station” refers to the station that is displayed as a report entry. 


Partner 


% Usage 


When used as a From field, Partner is the most recent station 
that received traffic from this station. The code is FPARTNER. 


When used as a To field, Partner is the most recent station that 
transmitted traffic to this station. The code is TPARTNER. 


When used as a Both field, Partner is the name of the station 
that this station most recently transmitted traffic to or received 
traffic from. The code is BPARTNER. 


When used as a From field, % Usage is the network usage 
caused by the amount of traffic transmitted from this station. 


When used as a To field, % Usage is the network usage caused 
by the amount of traffic sent to this station. 


When used as a Both field, % Usage is the network usage 
caused by traffic that is sent from and to this station. 


Regardless of the class of traffic, the % Usage field has these 
options: 

Absolute represents the absolute network usage; Relative 
represents the relative network usage. 


Numeric displays the network usage in numbers (without the 
percent sign). Graphic displays the network usage in a graph. 
You can choose the scale for the axis, which can be 0.4, 2, 10, 20, 
50, or 100%. 


The following table lists the codes used for this field. 


Relative 
From FURE 
To TORE 
Both BURE 
Figure B~2. Codes for the % Usage fields in the numeric format. 
Relative 
From FUSAGE REL 
To TUSAGE REL 
Both BUSAGE REL 


Figure B-3. Codes for the % Usage fields in the graphic format. 
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Frames 


Errors 


Bytes 


Avg Size 


First 


Last 


Elapsed 
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When used as a From field, Frames is the number of frames 
sent from this station. The code is FFRAME. 


When used as a To field, Frames is the number of frames sent 
to this station. The code is TFRAME. 


When used as a Both field, Frames is the number of frames sent 
from and to this station. The code is BFRAME. 


Whether Errors is used as a From or Both field, it is the number 
of soft error report frames sent from this station. This field does 
not exist as a To field. The codes are FER and BER for the From 
field and Both field, respectively. 


When used as a From field, Bytes is the number of bytes sent 
from this station. The code is FBYTE. 


When used as a To field, Bytes is the number of bytes sent to 
this station. The code is TBYTE. 


When used as a Both field, Bytes is the number of bytes sent to 
and from this station. The code is BBYTE. 


When used as a From field, Avg Size is the average size of the 
frames sent from this station. The code is FAV. 


When used as a To field, Avg Size is the average size of the 
frames sent to this station. The code is TAV. 


When used as a Both field, Avg Size is the average size of the 
frames sent to and from this station. The code is BAV. 


When used as a From field, First is the time when this station 
first sent out traffic during the current monitoring session. The 
code is FFIRST. 


When used as a To field, First is the time when this station first 
received traffic during the current monitoring session. The 
code is TFIRST. 


When used as a Both field, First is the time when this station 
first received or sent traffic during the current monitoring 
session. The code is BFIRST. 


When used as a From field, Last is the time when this station 
made the most recent transmission. The code is FLAST. 


When used as a To field, Last is the time when the monitor 
detected the last frame containing this station’s address as the 
destination address. The code is TLAST. 


When used as a Both field, Last is the time when this station 
made the most recent transmission or when the monitor 
detected the last frame containing this station’s address as the 
destination address. The code is BLAST. 


When used as a From field, Elapsed is the length of time 
between the station’s first and last transmission in the current 
monitoring session. The code is FELAPSED. 


List of Codes 


Both 


History 


List of Codes 


When used as a To field, Elapsed is the length of time between 
the monitor’s first and last detection of the station’s address as 
a destination address. The code is TELAPSED. 


When used as a Both field, Elapsed is the length of the time 
period between the station’s first and last network activity, 
which can be a transmission or reception. The code is 
BELAPSED. 


Displays the station’s history statistics in the same format as the 
statistics view generated by Station history on the monitor’s 
Main Menu. 


When used as a From field, the display includes the number of 
frames sent from this station. The code is FHISTORY. 


When used as a To field, the display includes the number of 
frames sent to this station. The code is THISTORY. 


When used as a Both field, the display includes the number of 
frames both sent to and from this station. The code is 
BHISTORY. 


This field has several options: 


Absolute means that all network usage percentages in the 
report are absolute; Relative means that all network usage 
percentages in the report are relative. The codes are ABS and 
REL for Absolute and Relative, respectively. 


Numeric displays the station history statistics in numbers. The 
code is NUMERIC. Graphic displays the statistics in a graph. 
You can choose the scale for the axis, which can be 0.4, 2, 10, 20, 
50, or 100%. The code is GRAPHIC. 


In the report, the codes for the options are concatenated to form 
a single code. For example, if you select History as a To field, 
and Numeric and Absolute as the options, the code for the 
field is THISTORY NUMERIC ABS. 


This section lists all the codes alphabetically that can appear in a report script. 
They are arranged according to the fields under which they appear. 


Code 

BAV 
BBYTE 
BELAPSED 
BER 
BFIRST 


Report Field 
Avg Size 
Bytes 
Elapsed 
Errors 


First 
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Errors 


From 
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BFRAME 

BHISTORY GRAPHIC ABS 
BHISTORY GRPHIC REL 
BHISTORY NUMERIC ABS 
BHISTORY NUMERIC REL 
BLAST 

BPARTNER 

BUAB 

BURE 

BUSAGE ABS 

BUSAGE REL 


Code 
EOV 
EPU 
ESO 
ESTATE 


Code 

FAV 

FBYTE 

FELAPSED 

FER 

FEIRST 

FERAME 

FHISTORY GRAPHIC ABS 
FHISTORY GRPHIC REL 
FHISTORY NUMERIC ABS 
FHISTORY NUMERIC REL 
FLAST 

FPARTNER 

FUAB 


Frames 

History (Absolute, Graphic) 
History (Relative, Graphic) 
History (Absolute, Numeric) 
History (Relative, Numeric) 
Last 

Partner 

% Usage (Absolute, Numeric) 
% Usage (Relative, Numeric) 
% Usage (Absolute, Graphic) 
% Usage (Relative, Graphic) 


Report Field 
Oversize 
Purges 
SoftErrs 
State 


Report Field 

Avg Size 

Bytes 

Elapsed 

Errors 

First 

Frames 

History (Absolute, Graphic) 
History (Relative, Graphic) 
History (Absolute, Numeric) 
History (Relative, Numeric) 
Last 

Partner 


% Usage (Absolute, Numeric) 


Global 


FURE 
FUSAGE ABS 
FUSAGE REL 


Code 

GAV 

GBYTE 

GCI 

GCURRENT TIME 
GELAPSED 


GETHERTYPES.BYTES. 
ALL.FRAMES 


GETHERTYPES.BYTES. 
SNAP.ONLY 


GETHERTYPES.FRAMES. 
ALL.FRAMES 


GETHERTYPES.FRAMES. 
SNAP.ONLY 


GFIRST 

GFRAME 

GFRAME SIZES 
GHISTORY GRAPHIC ABS 
GHISTORY NUMERIC ABS 
GLAST 

GMI 

GMON ACTIVE 

GMON END 

GMON START 
GROUTE.LENGTHS 
GROUTE.PATHS 

GS 

GSAPS.BYTES 
GSAPS.FRAME 

GUAB 


List of Codes 


% Usage (Relative, Numeric) 
% Usage (Absolute, Graphic) 
% Usage (Relative, Graphic) 


Report Field 

Avg Size 

Bytes 

Stations (Current Inserted Stns) 
CurrTime 


Elapsed 

Ethertypes (Bytes and All Frames) 
Ethertypes (Bytes and SNAP only) 
Ethertypes (Frames and All Frames) 


Ethertypes (Frames and SNAP only) 
First 

Frames 

FrmSizes 

History (Graphic) 

History (Numeric) 

Last 

Stations (Maximum Inserted Stns) 
Active 

End 

Start 

Routing (Lengths) 

Routing (Paths) 

Stations (Total Stations) 

SAPs (Bytes) 

SAPs (Frames) 

% Usage (Numeric) 
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GUSAGE ABS % Usage (Graphic) 
Station 
Code Report Field 
SADDRESS Address 
SC CSV RET 
SHISTORY STN. Hist Stn 
SNAME Name | 
95 Sort Pos 
SSTATUS Status 
oT Text 
To 
Code Report Field 
TAV Avg Size 
TBYTE Bytes 
TELAPSED Elapsed 
TFIRST First 
TFRAME Frames 
THISTORY GRAPHIC ABS History (Absolute, Graphic) 
THISTORY GRPHIC REL History (Relative, Graphic) 
THISTORY NUMERIC ABS History (Absolute, Numeric) 
THISTORY NUMERIC REL History (Relative, Numeric) 
TLAST Last 
TPARTNER Partner 
TUAB % Usage (Absolute, Numeric) © 
TURE % Usage (Relative, Numeric) 
TUSAGE ABS % Usage (Absolute, Graphic) 
TUSAGE REL % Usage (Relative, Graphic) 
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twork 
General 


Appendix C. Ethertype Values in SNAP SAPs 


Overview 


Ethertypes 


This appendix lists the hexadecimal values of the various Ethertypes in SNAP 


SAPs. 


The following is a list of Ethertype values that you can add to the 


STARTUP.ENT file: 

0000-05DC IEEE 802.3 Length Field 

0200 Xerox PUP (conflicts with IEEE 802.3 Length Field range) 

0201 Xerox PUP Address Translation (conflicts with IEEE 802.3 
Length Field range) 

0600 Xerox NS IDP 

0800 DOD Internet Protocol (IP) 

0801 X.75 Internet 

0802 NBS Internet 

0803 ECMA Internet 

0804 CHAOSnet 

0805 X.25 Level 3 

0806 Address Resolution Protocol (ARP) (for IP and for CHAOS) 

0807 XNS Compatibility 

081C Symbolics Private 

0888-088A Xyplex 

0900 Ungermann-Bass network debugger 

0A00 Xerox IEEE 802.3 PUP 

OA01 Xerox IEEE 802.3 PUP Address Translation 

OBAD Banyan Systems 

1000 Berkeley Trailer negotiation 

1001-100F Berkeley Trailer encapsulation for IP 

1600 VALID system protocol 

4242 PCS Basic Block Protocol 

5208 BBN Simnet Private 

6000 DEC unassigned, experimental 
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6001 DEC Maintenance Operation Protocol (MOP) Dump/Load 
| Assistance 

6002 | DEC Maintenance Operation Protocol (MOP) Remote 

Console 

6003 DECnet Phase IV, DNA Routing 

6004 DEC Local Area Transport (LAT) 

6005 DEC diagnostic protocol (at interface initialization) 

6006 DEC customer protocol 

6007 DEC Local Area VAX Cluster (LAVC), System 

Communication Architecture (SCA) 

6008 DEC unassigned 

6009 DEC unassigned 

6010-6014 3Com 

7000 Ungermann-Bass download 

7002 Ungermann-Bass diagnostic/loopback 

7020-7029 LRT 

7030 Proteon 

7034 Cabletron 

8003 Cronus VLN 

8004 Cronus Direct 

8005 HP Probe protocol 

8006 AT&T 

8010 Excelan 

8013 Silicon Graphics diagnostic 

8014 Silicon Graphics network games 

8015 Silicon Graphics reserved 

8016 Silicon Graphics XNS NameServer, bounce server 

8019 Apollo DOMAIN 

802E Tymshare 

802F Tigan 

8035 Reverse Address Resolution Protocol (RARP) 

8036 Aeonic Systems 

8038 DEC LAN Bridge Management 

8039 DEC unassigned 

803A DEC unassigned 

803B DEC unassigned 


C-—4 (Resor) 


803C 
803D 
803E 
803F 
8040 
8041 
8042 
8044 
8046 
8047 
8049 
805B 


805C 
805D 

8060 

8062 

8065 

8066 

8067 

8068 

8069 

806A 
806C 
806D 
806E-8077 
807A 
807B 
807C 
807D-807F 
8080 
8081-8083 
809B 
809C-809E 
809F 


Ethertypes 


DEC unassigned 

DEC Ethernet CSMA/CD Encryption Protocol 
DEC unassigned 

DEC LAN Traffic Monitor Protocol 
DEC unassigned 

DEC unassigned 

DEC unassigned 

Planning Research Co. 

AT&T 

AT&T 

ExperData 


VMITP (Versatile Message Transaction Protocol, RFC-1045) 
(Stanford) 


Stanford V Kernel, version 6.0 

Evans & Sutherland 

Little Machines 

Counterpoint Computers 

University of Massachusetts, Amherst 
University of Massachusetts, Amherst 
Veeco Integrated Automation 
General Dynamics 

AT&T 

Autophon 

ComDesign 

Compugraphic 

Landmark Graphics 

Matra 

Dansk Data Elektronik 

Merit Internodal (or University of Michigan) 
Vitalink 

Vitalink TransLAN III Management 
Counterpoint Computers 

EtherTalk (AppleTalk over Ethernet) 
Datability 

Spider Systems 
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80A3 
80A4-80B3 
80C0-80C3 
80C6 

80C7 
80C8-80CC 
80CD-80CE 
80CF-80D2 
80D3-80D4 
80D5 
80DD 
80DE-80DF 
80E0-80E3 
80E4-80F0 
80F2 

80F3 
80F4-80F5 
80F7 
80FF-8103 
8107 

8108 

8109 

8130 

8131 

8137 

8138 
8139-813D 
9000 

9001 

9002 

9003 

FFO0 


Nixdorf Computers 


Siemens Gammasonics 


DCA (Digital Comm. Assoc.) Data Exchange Cluster 


Pacer Software 

Applitek 

Intergraph 

Harris 

Taylor Instrument 

Rosemount 

IBM SNA Services over Ethernet 


Varian 


Integrated Solutions Transparent Remote File System (TRFS) 


Allen-Bradley 

Datability 

Retix 

AppleTalk Address Resolution Protocol (AARP) 
Kinetics 

Apollo 

Wellfleet 

Symbolics Private 

Symbolics Private 

Symbolics Private 

Waterloo Microsystems 

VG Laboratory Systems 

Novell (old) NetWare IPX (ECONFIG E option) 
Novell 

KTI 

Loopback (Configuration Test Protocol) 

Bridge Communications XNS Systems Management 
Bridge Communications TCP/IP Systems Management 
Bridge Communications 

BBN VITAL-LANBridge cache wakeups 
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Alarm 5—4 
In d eX Alarm buffer 3-18, 5-3, 5-12, 8-5 


Alarm log option 3-18, 9-7 


Alarm Log view 9-7 
displaying 3-18, 5-12 


Numerics Alarm Log view (figure) 9-23 
3Com, Ethertype value C-4 Alarm option 4-8, 5-14 
A Alarm processing (figure) 5-3 


Alarm threshold information 


Absolute network usage 3-4 in Manage Station Information view 4-6 


Absolute vnc Alarm thresholds 
filter for reports 9-34 changing 48, 5-8 
Access control scheme global 54 
token ring network 7-6 inSTARTUP.TRA 8-3 
Acknowledging alarms saving 4-9 
inalarmlog 5-12 types 5-4, 9-27 
pressing F3 3-18 ALARM.LOG 5-14, 5-15, 9-29 
Active monitor Alarms 
as an inserted station 6-23, 9-8 acknowledging 5-12 
definition 9-16 clearing 5-12, 9-23 
disconnecting from network 9-9 clearing automatically 5-14 
position in RINGORDR.SCR 6-8 clearing manually 5-14 
selecting 9-9 different ways of clearing 5-13 
sending a Ring Purge MAC frame 9-10 interpreting 5-7 
Active Poll fail alarm 5-5, 9-28 logging 5-14 
Active stations printing 5-14, 9-29 
definition 9-16, 9-32 printing automatically 5-14 
displaying in statistical views 3-11 priority levels 54, 9-29 
Adding a blank line in a report script 6-25 saving todisk 5-14, 9-29 
Adding addresses to station data files 4-3 en Eiresnioles a 
Adding addresses to station list 2-17 a ba one type of frame or station 2-16, 
Adding headers in report scripts 6-25 with unmodifiable thresholds 5-4, 5-6 


Adding protocols to STARTUP.TRT with EDLIN 3-16, Align history 9-5 
Nios Align history (figure) 9-6 


Address | 
adding to station data files 4-3 Align history option 9-5 
All frames option 2-17, 9-5 


broadcast 84 


filter for reports 9-34 All stations option 
group 9-17 Display menu 9-7 
sourceinaframe 9-19 Monitor filters menu 2-16, 3-6, 9-4 
station 44, 8-3, 84 All Stations Statistics view 
Address Resolution Protocol (ARP) (for IP and for CHA- graphic (figure) 9-18 
OS), Ethertype value C-3 numeric (figure) 9-17 
Aeonic Systems, Ethertype value C-4 Allen-Bradley, Ethertype value C-6 
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Analyzer 
starting 2-21 
use of STARTUP.TRD 2-16, 2-18 
use of STARTUP.TRI 84 
use of station data files 4-3 


AND operator 
using with report filters 6-24, 6-25, 9-32 


Apollo DOMAIN, Ethertype value C-4 
Apollo, Ethertype value C-6 
Appending alarms to existing ALARM.LOG 5-15 


AppleTalk Address Resolution Protocol (AARP), Ether- 
type value C-6 


Applitek, Ethertype value C-6 


Applying default station thresholds 
pressing F2 5-11 


Ascending order 
sorting statistics in reports 6-22 


Assigning aSAP value inSTARTUP.TRT 8-5 
Assigning a value to an option 2-12 
Assigning default alarm settings 4-3 
AT&T, Ethertype value C-4, C-5 
Audible alarms 9-38 
Auto clear option 5-13, 5-14, 9-29 
Auto print option 
Report menu 9-34 


Automatic report generation 
terminating 6-18 


Automatically clearing alarms 5-14 
Automatically printing alarms 5-14 
Autophon, Ethertype value C-5 


Average frame size 
for each station 7-6 
sorting station statistics by 3-10 


_Average network usage in a monitoring session 9-8 


Average size 
filter for reports 9-33 


Average size of transmitted frames 9-8 
Axis in a graphic statistical view 3-4 


Background monitoring 

meaning 2-20 

stopping 2-21 
Backup copies 

station data files 43, 8-3 
Backup copies of station data files 4-9 
BACKUP.TRA 4-3, 8-3 
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BACKUP.TRD 4-3, 8-3 
Banyan Systems, Ethertype value C-3 


Baseline for your network 
examining frame size distributions 7-5 
examining the transmit timer 7-6 
gathering history statistics 7-3 
generating station history report 7-4 
protocol testing 7-5 


BBN Simnet Private, Ethertype value C-3 


BBN VITAL-LANBridge cache wakeups, Ethertype value 
C-6 


Beacon frames 5-6, 9-9 

Beaconing network 9-9 

Berkeley Trailer encapsulation for IP, Ethertype value 
C-3 

Berkeley Trailer negotiation, Ethertype value C-3 

Blank report script 6-20 


Bridge Communications TCP/IP Systems Management, 
Ethertype value C-6 


Bridge Communications XNS Systems Management, 
Ethertype value C-6 


Bridge Communications, Ethertype value C-6 
Bringing background monitoring to foreground 2-21 
Broadcast address 8-4 
Broadcast frames 5—5, 9-20, 9-28 
Broadcast storm alarm 5-5, 9-27 
Busy token 7-6 
Bytes 
filter for reports 9-33 


C 
Cabletron, Ethertype value C-4 
Calculating average size of transmitted frames 9-8 
Capabilities of the monitor 1-3 
Carriage return symbol in Main Menu 2-10, 2-11 
Changing 
astationname 9-36 
ane Sa during a monitoring session 4-7, 
default station alarm thresholds 5-11 
global alarm thresholds 5-8, 5-10 


global or station alarm thresholds by pressing F7 
4-8 


network speed 2-16, 9-38 
station alarm thresholds 4-7 


CHAOSnet, Ethertype value C-3 
Character strings in CSV reports 6-16 
Characters available in report scripts 


displaying by pressing F7 6-25 
Choosing a value for an option 2-12 


Class of traffic 3-3, 9-7 
definition 3-4 
in Station History views 3-20 
setting for station history statistics 7-4 


_ Class option 34, 3-8, 3-22, 9-7 
Clear alarm file option 5-15, 9-29 


Clear option 
Report menu 9-34 


Clearing a report script 6-20 


Clearing alarms 3-18, 9-23 
effects 5-13 
pressing F4 3-18, 5-14 


Clearing alarms automatically 9-27 
Clearing alarms manually 5-14 

Clearing contents of the report editor 9-34 
Clearing HISTORY.LOG 9-6 

Clock in a statistical view 3-5 

Codes in report scripts 6-21 

Colors used in graphic displays 3-8 
ComDesign, Ethertype value C-5 


Commas 
inserting to separate report fields 6-16 


Compugraphic, Ethertype value C-5 


Configuration 
monitor settings 2-5 


Configuring the network's data buffers 3-13 
Connectivity problems 2-19, 7-5 


Counterpoint Computers, Ethertype value C-5 


Creating a report script 6-20 
Creating backup data files 4-3 
Cronus Direct, Ethertype value C-4 
Cronus VLN, Ethertype value C-4 
Current network usage 9-8 


Current time 
graphic Global Statistics view 9-10 


Cursor keys 2-10 
Cursor position in a report script 6-21 


D 
Dansk Data Elektronik, Ethertype value C-5 


Data rate 
monitor 1-3 


Datability, Ethertype value C-5, C-6 


Index 


DCA (Digital Comm. Assoc.) Data Exchange Cluster, 
Ethertype value C-6 


DEC customer protocol, Ethertype value C-4 


DEC diagnostic protocol (at interface initialization), 
Ethertype value C-4 


DEC Ethernet COMA/CD Encryption Protocol, Ethertype 
value C-5 


DEC LAN Bridge Management, Ethertype value C-4 
DEC LAN Traffic Monitor Protocol, Ethertype value C-5 
DEC Local Area Transport (LAT), Ethertype value C-4 


DEC Local Area VAX Cluster (LAVC), System Commu- 
nication Architecture (SCA) 


Ethertype value C-4 


DEC Maintenance Operation Protocol (MOP) Dump/ 
Load Assistance, Ethertype value C-4 


DEC Maintenance Operation Protocol (MOP) Remote 
Console, Ethertype value C-4 


DEC unassigned, experimental, Ethertype value C-3 
DECnet Phase IV, DNA Routing, Ethertype value C-4 


Default alarm thresholds 
station 9-28 


Default option settings 2-3 


Default station alarm thresholds 
changing 5-11 


Deferring alarms when alarm buffer is full 5-12 
Defining report filters 6-24 

Deleting a line in a report script 6-25 

Deleting alarms 3-18, 5-12 

Deleting broadcast address 8-4 

Deleting stations 4-8 


Delimited format 
reports 6-15 


Delimited format option 9-6, 9-32 
Delimited report format 6-19, 8-5, 9-6 


Descending order 
sorting statistics in reports 6-22 
Deviations from normal traffic patterns 7-3 
Disconnecting monitor station from network 9-9 
Display 
freezing 3-5 
Display option 9-7 
Display options 
numeric vs. graphic 3-4 
Displaying 
a report by pressing F9 6-17, 6-25 
alarm log 5-12, 9-22 
Alarm Log view 5-12 
duration of a monitoring session 3-6 
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ethertypes 3-16 
frame sizes 9-18 
global history 9-23 
global statistics 3-6, 9-7 
_ Help menu by pressing Fl 2-15 
history statistics fora station 7-3 
Main Selection Menu 9-38 
Manage Station Information view 4-6, 9-36 
network speed 9-38 
options by pressing F6 2-14 
protocols 3-16 
Report Script Editor view 9-31 
routing information 9-19, 9-21 
sorted statistics for all stations 9-15 
station history statistics 3-20, 3-22, 9-25 
station statistics 3-7, 9-11 
statistics by pressing F3 2-14, 3-3 
statistics for all stations 3-9 
the station list 2-16, 2-17 
Distribution of bytes by protocol types (figure) 3-16, 
9-21 
DOD Internet Protocol (IP), Ethertype value C-3 
Duration of a monitoring session 3-6 


E 

ECMA Internet, Ethertype value C-3 

Edit option 
Alarm menu 4-3, 5-11, 9-27 
Manage stationmenu 4-3 
Report menu 9-31 

Editing 
report scripts 6-20, 9-35 
station information 4-5 

Editing astationname 9-36 


Editing report scripts 
using function keys 9-35 


Editing station information 9-36 


EDLIN 
for adding protocols toSTARTUP.TRT 3-16, 9-21 


Effects of clearing alarms 5-13 


Elapsed activity 
filter for reports 9-33 
sorting station statistics by 3-10 


Embedded commas in report fields 6-15 


End key 
viewing the last screen of statistical view 3-5 


Entering text in a report script 6-21 
Entering the @ symbol in a report script 6-22 
Erasing contents of report editor 9-34 
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Erasing history statistics 3-19 
Erasing station history statistics 3-20 


Error counts 
numeric Global Statistics view 3-6, 9-9 


Error frames 
sorting station history statistics by 7-4 


Error messages A-3 to A-7 


Errors 
filter for reports 9-33 


Errors alarm 
station 9-28 


Errors alarm threshold 5-5, 5-7, 9-28 
station alarm 9-36 


ERRORS report 
determining station errors threshold 5-9 


Errors report frames 3-7 
Errors report script 6-4, 9-30 
ERRORS.SCR 6-4, 9-30 


Esc 
returning to previous screen 2-14 


EtherTalk (AppleTalk over Ethernet), Ethertype value 
C-5 


Ethertype format 3-16, 9-22 

Ethertype values C-3 to C-6 

Ethertypes display 3-16 

Evans & Sutherland, Ethertype value C-5 


Exceeding the alarm buffer's capacity 
consequence of 5-12 


Excelan, Ethertype value C-4 

Exit option 2-21, 9-38 

ExittoDOS 4-9 

Exiting the monitor user interface 9-38 
ExperData, Ethertype value C-5 
Exporting report files 6-16 


F1 
displaying Help menu 2-14, 2-15 


F10 
starting or stopping a monitoring session 2-14, 
2-18 


stopping a monitoring session 2-20 
F2 

applying default station thresholds 5-11 
F3 

acknowledging alarms 3-18 

displaying statistics 2-14, 3-3 


F4 

clearing alarms 3-18, 5-14 
F5 

returning to Main Menu 2-14 


F6 
displaying options 2-14 
resetting station alarm thresholds 4-8 
F7 
changing global or station alarm thresholds 4-8 
displaying available characters in report scripts 
6-25 
scaling up the axis ina graphic display 34 
F8 
scaling down the axis ina graphic display 3-4 
F9 
displaying areport 6-17, 6-25 
freezing screen display 3-5 
redisplaying after freezing the screen 3-5 
File option 
Alarm\Logtomenu 5-15, 8-5 
Filenames 
report scripts 6-26 
reports 6-19 
reports generated automatically 6-19 
reports generated manually or automatically 8-5 
reports saved to disk 6-19 
Filters 
examples 6-26 
for defining a report script 9-32 
specifying using the AND operator 6-25 
First activity 
filter for reports 9-33 
sorting station statistics by 3-10 
First network activity 3-6 
Format of statistical display 3-3 
Fragments 
in Frame Sizes view 9-19 
Frame size option 7-6 
Frame size report script 6-5, 9-30 
Frame sizes 
displaying 9-7 
Frame sizes option 3-13, 9-7 
Frame Sizes view 9-19 
for a 4 Mbps network (figure) 9-18 


Frames 
Beacon 5-6, 9-9 
broadcast 5-5, 9-20, 9-28 
displaying the sizes 3-13 
filter for reports 9-33 


Index 


Logical Link Control (LLC) 2-15, 2-17, 9-5, 9-22 
Medium Access Control (MAC) 2-15, 2-17, 9-5 
non-source-routed 9-21 

oversized 5-6, 9-10 

report script for size distribution 6-5 

Ring Poll Failure 5-6 

Ring Purge 9-9 

Ring Purge MAC 9-10 

routed ornon-routed 9-19 

size distribution 7-5 

sizes 3-13, 7-4 

soft error report 3-6, 3-7, 5-7, 9-10 

test 9-4 

Trace Tool Present 9-16 

types tobe monitored 9-4 


Frames destined fora group address 9-20 
FRAMSIZE.SCR 6-5, 7-6, 9-30 
Free token 7-6, 9-10 


Freezing a screen display 
pressing F9 3-5 

Function keys 2-14, 3-5 
for editing report scripts 9-31, 9-35 
for editing station information 9-37 


G 

General Dynamics, Ethertype value C-5 
Generating reports 6-16 

Global alarm thresholds 5-4, 5-5 


Global alarms 
active poll fail 5-5, 9-28 
broadcast 5-13 
broadcast storm 5—5, 9-27 
errors 5-13 
idle 5-13 
networkidle 5-5, 9-28 
network usage 5-5, 9-28 
oversized frames 5-5, 9-27 
priority level 5—4 
ring beaconing 5-5, 9-28 
softerrors 5-5, 9-28 
unknown station 5-5, 5-13 
usage 5-13 
Global history option 3-19, 7-3, 9-7 
Global history statistics 
displaying 3-18, 3-19 
Global History Statistics view 7-3 
graphic 3-19 
graphic (figure) 9-25 
numeric 3-19 — 
numeric (figure) 9-24 
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Global statistics option 9-7 
Global Statistics view 3-5 

displaying 3-6 

graphic 9-10 

graphic (figure) 9-11 

numeric 9-8 to 9-10 

numeric (figure) 9-9 
Graphic All Stations Statistics view 9-17 
Graphic Global History Statistics view 9-24 
Graphic option 3-6, 9-8, 9-11, 9-15, 9-23 
Graphic Single Station view 9-13 
Group address 9-17 
Group stations 6-8, 9-15 


H 


Harris, Ethertype value C-6 
Header text ina printed report 6-17 


Help menu 
pressing Fl 2-14 


Highest number of inserted stations 

in Global Statistics view 9-8 
Highlighted options in the Main Menu 2-10 
Highlighting a menu option 2-10 
Highlighting analarm 3-18 
History intervals 7-3, 9-5, 9-25 

aligning 9-5 

aligning (figure) 9-6 

changing during a monitoring session 3-19, 3-20 
History option 9-5 
History report 

fora station 7-4 
History report script 6-6, 9-30 
History statistics 

defining 2-17 

erasing 3-19 

for a particular station 7-3 

global 3-18 


HISTORY.CSV 8-5, 9-6 
HISTORY.LOG 7-3, 8-5, 9-6 
HISTORY.SCR 6-6, 9-30 


Home key 
viewing the first screen of statistical view 3-5 


HP Probe protocol, Ethertype value C-4 


| 
IBM LAN Manager 1-4, 2-17, 9-9 
IBM SNA Services over Ethernet, Ethertype C-6 
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Identifying stations 44 


Idle alarm 
station 9-28 


Idle alarm threshold 
global 5-5, 9-28 
station 5-7 


Idle network 5-5, 9-28 


Idle threshold 
station alarm 9-36 


IEEE 802.2 option 9-4 
IEEE 802.2 protocol 7-5, 9-4 


IEEE 802.3 Length Field, Ethertype value C-3 


IEEE 802.5-compatible network 1-4 
Inactive stations 6-8, 9-15, 9-17 
Inoperable network 9-9 
Inserted stations 3-11 
definition 6-23, 9-16, 9-32 
displaying the number of 9-8 
Inserting a report field 6-21 


Integrated Solutions Transparent Remote File System 
(TRFS), Ethertype value C-6 


Interacting with the monitor 2-10 
Intergraph, Ethertype value C-6 
Interrupting the automatic naming process 4-5 
Intervals 

history 9-25 

to which global thresholds apply 54 
Intrvl option 9-5 
IPX protocol 7-5 


K 
Keys 

for scrolling displays 3-5 
Kinetics, Ethertype value C-6 
KTI, Ethertype value C-6 


L 
LAN Manager 
IBM 9-9 
Landmark Graphics, Ethertype value C-5 
Last activity 
filter for reports 9-33 
sorting station statistics by 3-10 
Last network activity 3-6 
Length 
routing 3-14, 9-20 
Length Bits ina frame 9-20 


. Length of a monitoring session 3-6 
Length of astationname 4-6 
Limitations of background monitoring 2-20 
Limiting stations ina report 6-24 
Line error 9-10 
List of report fields 6-21 
List of report scripts 4-5 
Listeners report script 6-7, 9-30 
LISTENRS.SCR 6-7, 9-30 
Little Machines, Ethertype value C-5 
LLC frames option 2-17, 9-5 
Load option 6-16, 9-29 
Loading a report script 4-5, 6-16 
Loading the monitor application program 2-8 
Loading the monitor driver into memory 2-8, 2-21 
Local token ring network 9-19 
Log to disk option 9-6 
Log to option 
using with Auto clear 5-13 
Logging alarms to disk 5-14, 9-29 
Logging history statistics to disk 9-6 


Logical Link Control (LLC) frames 2-15, 2-17, 9-5, 
9-22 


Loopback (Configuration Test Protocol), Ethertype value 
C-6 


Losing unnamed addresses 2-20 
Lost frame error 9-10 

Lost token 9-10 

LPT1 5-14, 6-17 

LPT2 5-14, 6-17 

LRT, Ethertype value C-4 


M 
MAC frames option 2-17, 9-5 
MAC option 9-4 
MAC protocol 7-5, 9-4 
Main Menu 
carriage return symbol 2-10 
highlighted options 2-10 
monitor 2-3 
monitor (figure) 2-8 
panels 2-10 
pressing Enter 2-10 


Main Selection Menu 
Sniffer Network Analyzer 2-21, 9-38 
Manage Station Information view 9-36 
alarm thresholdinformation 46 


Index 


displaying 4-3, 46 

modifying STARTUP.TRA 84 

modifying STARTUP.TRD 84 

order of stations 46 

unnamed addressesin 44 

usage of function keys 9-37 
Manage Station Information view (figure) 44, 9-37 
Manage Stations Information view 

modifying STARTUP.TRD 84 
Manage stations option 4-5, 46, 4-9 
Manually naming stations 4-5 
Manufacturer's code 

in station addresses 8-4 
Matra, Ethertype value C-5 
Maximum frame size 9-10 
Maximum number of entries in STARTUP.TRI 84 
era number of entries in STARTUP.TRT 3-16, 
Maximum number of SAP entriesin STARTUP.TRT 8-5 
Maximum number of SAP labels in STARTUP.TRT 8-5 
Measuring transmit wait time 7-6 

number of frames transmitted 9-4 
ee Access Control (MAC) frames 2-15, 2-17, 5-7, 
MENU command 4-9 
Menu items 9-3 
Menu options 

for specifying values 2-11 

highlighting 2-10 
Menu structure 

choosing options 2-11 

monitor 2-10 

moving through 2-10 
Menus 

monitor 2-10 
eee (or Univ of Michigan), Ethertype value 


Modifying station data files 
in Manage Station Information view 4-3 


Modifying valuesin menus 2-11 


Monitor 
alarm buffer 8-5 
application program 2-8 
assigning default alarm settings to stations 4-3 
backup copies of data files 4-3 
capabilities of 1-3 
configuration 2-3 
datarate 1-3 | 
default option settings 2-3 . 
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driver 2-8 automatically 4-5, 9-36 

interacting with 2-10 in Manage Station Information view 46 
Main Menu 2-3 manually 4-5 

Main Menu (figure) 2-8 Naming stations automatically 

menuitems 9-3 interrupting 4-5 

menu structure 2-10 | NBSInternet, Ethertype value C-3 


network speed 9-38 
on-line help 2-15 
processing alarms (figure) 5-3 


NetBIOS 
protocol 7-5, 9-4 
remote status request command 9-4, 9-36 


starting 2-8 
system requirements 1-4 NetBIOS option 9-4 
typical application 1-4 NetBIOS station test 7-5 
unloading driver from memory 2-20 NetBIOS test frame 9-4 
use of function keys 2-14 NetWare option 9-4 
user interface 2-10 NetWare protocol 7-5, 9-4 
Monitor contention on a token ring network 9-9 Network 
Monitor driver inoperable 9-9 
loading intomemory 2-8, 2-21 Network Adapter Status screen 7-5, 9-4 


unloading from memory 2-20, 2-22, 44 
; Network capacity 
Monitor filters option 2-16, 2-17, 2-18, 5-7, 9-4 for measuring network usage 3-4 


Monitor menus 2-10 Network idle 5-5, 9-28 


Monitor Services Menu 2-21 Network interface card 


Monitor station setting network speed 2-16, 9-38 


disconnecting from network 9-9 Network programs 

Monitoring effects on frame size distributions 7-6 
restricting 2-15 Network speed 1-4, 2-16, 9-38 

Monitoring a single station 5-7 Nectar beatae 

Monitoring session for measuring network usage 3-4 
average network usage 9-8 network programs’ effectson 7-6 
backgr ound 2-20 Network traffic patterns 
duration 3-6 during different times of year 7-3 
number of stations 9-8 typical 7-3 


starting 2-15, 2-18 


stopping 2-20 Network type 1-4 


Moving through menus 2-10 Network usage 3-3, 3-4, 5-5, 9-28 


current 9-8 
Moving within Help menu 2-15 dctnition. 3-4 
Moving within the Manage Station Information view sorting station statistics by 3-10 
i Network usage in Station History views 3-20 
Multiple files 


Network usage option 3-4, 3-22, 9-7 
Network's data buffers 

configuring 3-13 
Network's normal traffic patterns 7-3 


printing reports automatically 6-18 
Multiple SAP values in STARTUP.TRT 8-5 
Mutually exclusive options 2-11 


N Nixdorf Computers, Ethertype value C-6 
Name No response alarm 9-28 

filter for reports 9-33 No response alarm threshold 5-7, 9-36 
Name for the broadcast address 8-4 Non-routed frames 9-19 
Named addresses 4-3 Non-source-routed frames 9-21 
Naming stations 2-19, 44 Non-transmitting stations 9-20 
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Normal file format 


definition 6-15 


Normal network operation 


indicated in Global Statistics view 9-9 


Normal traffic patterns 


Novell (old) NetWare IPX (ECONFIG E option), Ether- 


getting familiar with 7-3 


type value C-6 


Novell, Ethertype value C-6 
Number of bytes 


sorting station statistics by 3-10 


Number of frames 


sorting station statistics by 3-10 


Number of frames transmitted 


measuring transmit wait time 9-4 


Number of history intervals 9-5 


Number of lines in a printed report 6-17 


Number of soft errors 


sorting station statistics by 3-10 


Number of stations 


Numeric Global History Statistics view (figure) 3-19 


displayed in a graphic All Stations Statistics view 


Numeric Global Statistics view (figure) 3-6 
Numeric option 3-6, 9-8, 9-11, 9-15, 9-23 
Numeric Single Station view 3-7 


Numeric view 


O 


all stations statistics 9-16 

Global History Statistics 3-19, 9-24 
Global Statistics 3-5 

single station 3-7, 9-12 to 9-13 
Station History Statistics 9-25 


On-line help 2-15 
Options 


Alarm 48, 5-14 

Alarm log 3-18, 9-7 

Align history 9-5 

Allframes 2-17, 9-5 

All stations 3-6 

All stations in Display menu 9-7 

All stations in Monitor filters menu 2-16 
All stations option in Monitor filters menu 9-4 
Autoclear 5-13, 5-14, 9-29 

Auto print in Report menu 9-34 

Class 3-4, 3-8, 3-22 

Clear alarm file 5-15, 9-29 

Clear in Report menu 9-34 


Index 


default settings 2-3 

Delimited format 9-6, 9-32 

Display 9-7 

Editin Alarm menu 4-3, 5-11, 9-27 
Edit in Manage station menu 4-3 
Edit in Report menu 9-31 

Exit 2-21, 9-38 

File in Alarm\Log to menu 5-15, 8-5 
Frame sizes 3-13, 7-6, 9-7 

Global history 3-19, 7-3, 9-7 

Global statistics 9-7 

Graphic 3-6, 9-8, 9-11, 9-15, 9-23 
History 9-5 

IEEE 802.2 9-4 

Intrvl 9-5 

list of 2-11 

LLC frames 2-17, 9-5 

Load 6-16, 9-29 

Logto 5-13 

Log to disk 9-6 

MAC 9-4 

MAC frames 2-17, 9-5 

Manage stations 4-5, 46, 4-9 
Monitor filters 2-16, 2-17, 2-18, 5-7, 9-4 
NetBIOS 9-4 

NetWare 9-4 

Network usage 3-4, 3-22, 9-7 
Numeric 3-6, 9-8, 9-11, 9-15, 9-23 
Option 9-38 

Page size in Alarm\Log to\Printermenu 5-14 
Page size in Report\Print menu 6-17 
Print in Report menu 6-17, 9-34 
Print to device in Report\Auto print menu 6-18 
Printer in Alarm\Logtomenu 5-14 
Probe fornames 4-5, 8-4 

Report 4-5 

Reset thresholds 5-12 

Route length 3-14 

Route path 3-14 

Routinginfo 3-14, 9-7 

SAP protocol types 3-16, 9-7 

Save in Report menu 9-34 

Single station 3-8, 9-7 

Sort by in Display\ All stations menu 9-15 
Start time in Report\Auto print menu 6-18 
Station history 3-22, 7-4, 9-7 
Station test 7-5 

Stn 2-16, 2-17, 2-18, 3-8, 44, 9-11 
Stn in History menu 9-5 

Stn in Monitor filters menu 9-5 

To in Station test menu 9-4 

traffic 9-7 
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Transmit timer 7-6 
Options option 9-38 
OR operator 

using with report filters 6-24, 9-32 
Order of alarms 5-12 


Order of station names | 
Manage Station Information view 4-6 


Order of stations on the token ring 3-10, 6-8 
Oversized frame alarm 5-5, 9-27 
Oversized frames 5-6 


p 
Pacer Software, Ethertype value C-6 
Page breaks in a printed report 6-17 
Page breaks in printed alarm logs 5~14 
Page size of printed alarm logs 5-14 
Page size option 

Alarm\Log to\Printer menu 5-14 

Report\Print menu 6-17 
Panels in the Main Menu 2-10 
Partner's name 

definition 3-10 

filter for reports 9-33 
PCS Basic Block Protocol, Ethertype value C-3 
Planning Research Co., Ethertype value C-5 
Previewing areport 6-16, 9-36 
Print option 

Report menu 6-17, 9-34 
Print to device option 

Report\Auto print menu 6-18 
Printer option 

Alarm\Logtomenu 5-14 
Printer ports 5-14 
Printing 

alarms 5-14, 9-29 

alarms automatically 5-14 

reports automatically 6-18 

reports manually 6-17 

the report header 6-17 

the station list 46 

the USERLIST report 4-6 
Priority levels 

global alarms 5-4 

meaning 9-29 

station alarms 5-9, 9-37 
Probe for names option 4-5, 8-4 
Proteon, Ethertype value C-4 
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Protocol types 3-16 


Protocols 
IEEE 802.2 7-5, 9-4 
MAC 7-5, 9-4 


NetBIOS 7-5, 9-4 
NetWare 7-5, 9-4 


Protocol-specific station tests 7-5 


R 


Recommendations 
acknowledging alarms 5-12 
avoiding statistics overflow 9-11, 9-14 
changing a filter value 6-24 
changing alarm thresholds 4-8, 5-8 
examining value of transmit timer 7-6 
knowing the length of transmit timer 7-6 
monitoring all stations 2-16 
naming stations 2-19 
report editing 6-25 
setting alarm thresholds 5-7 to 5-10 
setting history intervals 7-3 
setting the Class option 7-4 
using the Auto clear option 5-13 
Recording a station's history statistics 7-4 


Redisplaying after freezing the screen 
by pressing F9 3-5 


Relative network usage 3-4 
adding up to 200% 3-5 


Relative usage 
filter for reports 9-34 


Remote stations 6-8, 9-15, 9-16 


Remote status request command 
NetBIOS 9-4, 9-36 


Remote token ring network 9-20 
Removed stations 6-8, 9-15, 9-16 
Removing the monitor driver frommemory 2-20, 2-21, 
2-22, 4-4 
Removing the monitor from the token ring network 9-9 
Repeating a special character in a report script 6-25 
Report fields B-3 to B~12 
listof 6-21 
options 6-21 
spacing 6-21 
Report formats 
delimited 6-15, 8-5, 9-6 
normal 6-15 
Report header 6-17 
Report option 4-5 
Report Script Editor view 6-17, 6-20, 9-29, 9-31, 9-35 


Report scripts 
adding or deleting linesin 6~20 
comma-separated format 6-15 
creating 6-20 
cursor position 6-21 
definition 6-3 
editing 6-20 
editing textin 6-25 
ERRORS.SCR 6-4, 9-30 
FRAMSIZE.SCR 6-5, 9-30 
HISTORY.SCR 6-6, 9-30 
LISTENRS.SCR 9-30 
loading 6-16, 9-29 
RINGORDR.SCR 6-8, 9-30 
ROUTELEN.SCR 6-9, 9-30 
ROUTEPTH.SCR 6-10, 9-30 
samples 6-3, 6-16 
SAPS.SCR 6-11, 9-30 
saving 6-26, 9-34 
special characters 6-25 
TALKERS.SCR 6-12, 9-30 
types 9-30 
typing textin 6-21 
USERLIST.SCR 6-13, 9-30 
USERS.SCR 6-14, 9-30 
USERSCSV.SCR 6-15, 9-30 

Report settings 6-23 

Report title 6-17 

Reports 
adding or deleting linesin 6-25, 9-35 
delimited format 6-19, 9-6 
filenames 6-19 
filters 6-23, 9-32 
generating 6-16 
importing into other applications 6-16 
page size 6-17 
previewing 6-16, 9-36 
printing automatically 6-18 
printing manually 6-17 
saving to disk 2-22, 6-19, 9-35 
sorting stations 6-20, 6-22, 9-31 
using and repeating special characters 9-36 
using filtersin 6-20 

Reports generated automatically 
filenames 6-19 

Requirements for the monitor 1-4 

Reset thresholds option 5-12 


Resetting alarm thresholds 
pressing F6 4-8 


Resetting default station alarm thresholds 9-36 
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Resetting station alarm thresholds 5-11 
Restarting monitor after printing reports 6-18 
Retix, Ethertype value C-6 


Returning to Main Menu 
pressing F5 2-14 


Returning to previous screen 
pressing Esc 2-14 


Reverse Address Resolution Protocol (RARP), Ethertype 
value C-4 


RII bit 
value of 9-19 


Ring beaconing threshold 5-5, 9-28 
Ring order 9-15 
sorting stations statistics by 3-10 
Ring order of stations 6-8 
Ring order report script 6-8, 9-30 
Ring Poll Failure frames 5-6 
Ring purges 3-6, 9-10 
Ring state 9-9 
RINGORDR.SCR 6-8, 9-30 
Rosemount, Ethertype value C-6 
Route length option 3-14 
Route length report script 6-9, 9-30 
Route path option 3-14 
Route paths report script 6-10, 9-30 
Route Paths view 9-19 
Routed frames 9-19 
Routed traffic (figure) 1-4 
ROUTELEN.SCR 6-9, 9-30 
ROUTEPTH.SCR 6-10, 9-30 
Routing info option 3-14, 9-7 
Routing information 9-19 
displaying 3-14, 9-21 
Routing Information field 9-20 
Routing length 
definition 9-20 
Routing Lengths view 3-14, 9-20 
Routing Paths view 3-14 
Routing Paths view (figure) 9-19 


S 


Sample entries 
STARTUP.TRA 8-3 
STARTUP.TRI 84 


Sample report scripts 6-3, 6-16 
SAP protocol types 
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displaying 3-16, 9-21 
SAP protocol types option 3-16, 9-7 


SAP values 
in STARTUP.TRT 8-5 


SAPS report script 6-11, 9-30 
SAPS.SCR 6-11, 9-30 


Save option 
Report menu 9-34 
Saving 
alarms to disk 5-14, 9-29 
report scripts 6-26, 9-34 
reports to disk 6-19, 9-35 
Saving history statistics to disk 9-6 
Saving statistics by printing out reports 2-22 
Scaling down the axis in a graphic display 
pressing F8 3-4 
Scaling up the axis in a graphic display 
pressing F7 3-4 


Screen display 
scrolling 3-5 


SCRIPTS directory 6-3, 8-3, 8-6, 9-29 

scrolling Help menu 2-15 

Scrolling the screen display 3-5 

Scrolling the screen in statistical views 3-11 
Selecting a station in Manage Station Information view 


Setting priority levels 
station alarms 5-10 


Setting station alarm thresholds 

for devices handling heavy traffic 5-9 
Siemens Gammasonics, Ethertype value C-6 
Silicon Graphics diagnostic, Ethertype value C-4 
Silicon Graphics network games, Ethertype value C-4 
Silicon Graphics reserved, Ethertype value C-4 


Silicon Graphics XNS NameServer, bounce server 
Ethertype value C-4 
Single file 
printing reports automatically 6-18 
Single station option 3-8, 9-7 
Single Station Statistics view 
numeric (figure) 9-12 
Single Station Statistics view (graphic) 
figure 9~14 
Single Station view 3-7 
displaying 3-7 
graphic 3-8, 9-13 
numeric 9-12 
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Sizes of frames 7-4 
SNAP 3-16 
SNAP (Sub-Network Access Protocol) 9-22 


Sniffer Network Analyzer 
Main Selection Menu 9-38 
powering off 2-11 


Snooper stations 6-8, 6-23, 9-8, 9-15, 9-16 
Soft error report frames 3-6, 3-7, 5-7, 9-10 
Soft errors 5-5, 9-28 
Sort by option 
Display\All stations menu 9-15 
Sort keys for reports 6-22 
Sort keys for station statistics 3-10 
Sort position 
filter for reports 9-32 


sorted station names 
Manage Station Information view 4-7 


Sorted station statistics 3-9 


Sorting station history statistics 
byerrors 7-4 


Sorting stations by ring order 6-8 


Sorting statistics 
for all stations 9-15 


Sorting statistics in FRAMSIZE report 
by average frame size 7-6 


source address 
inaframe 9-19 


Spacebar 
for choosing values 2-11, 2-13 


Spacing between report fields 6-21 

Special characters in a report script 6-25 

Specifying aSAP valueinSTARTUP.TRT 8-5 
Specifying a station for history statistics collection 2-17 
pectying interval for printing reports automatically 


Specifying start time for printing reports automatically 
6-18 


Specifying the history interval 9-5 
Specifying types of statistics in All Stations view 3-11 
Specifying values in menus 2-11 
Speed 
network 1-4, 2-16, 9-38 
Spider Systems, Ethertype value C-5 


Spreadsheet programs 
using with reports 6-16 


Spreadsheet-compatible report format 8-5, 9-6 
Standby monitor 6-8, 6-23, 9-8, 9-15, 9-16 


Stanford V Kernel, version 6.0, Ethertype value C-5 


Start time option 
Report\Auto print menu 6-18 


Starting a monitoring session 2-15 
Starting a station test 
after stopping a monitoring session 9-4 


Starting or stopping a monitoring session 
pressing F10 2-14, 2-18 


Starting the analyzer 2-21 
Starting the monitor 2-8 


STARTUP.TRA 4-9, 8-3 
contents 4-3, 5-11, 8-3 
deleting stations from 4-8 
sample entry 8-3 


STARTUP.TRB 9-38 


STARTUP.TRD 84 
adding entries 6-13 
backup copy 4-9 
broadcast addressin 84 
contents 2-16, 4-3, 84 
deleting stations 4-8 
editing using EDLIN 4-3 
used by analyzer 2-18, 4-3 


STARTUP.TRI 
contents 84 
maximum number of entries 84 


STARTUP.TRT 3-16, 8-5, 9-21 


Station addresses 
adding to station list 2-17 
inSTARTUP.TRA 8-3 
inSTARTUP.TRD 84 
inSTARTUP.TRI 84 
naming 44 
viewing on screen 4-6 
Station alarm settings 
default 4-3 


Station alarm thresholds 5-7 
changing 4-7 
changing defaults for 5-11 
for new stations 5—4 
recommendations for setting 5-9 
resetting 5-11 
types 5-7 


Station alarms 
errors 5-13 
idle 5-13 
noresponse 5-13 
priority levels 5-9, 9-37 
setting priority levels 5-10 
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usage 5-13 
Station data files 
backup copies 4-3 
backup copies of 4-9 
deleting stations from 4-8 
resetting alarm thresholds 9-36 
used by analyzer and monitor 2-18, 4-3 
Station default thresholds 9-28 
Station errors alarm 9-28 
Station errors threshold 9-36 
Station history option 3-22, 7-4, 9-7 
Station history report 
generating 7—4 
Station history statistics 3-22 
displaying 3-20, 3-22 
erasing 3-20 
Station History Statistics view 
graphic (figure) 9-27 
numeric (figure) 9-26 
Station idle alarm 9-28 
Station idle alarm threshold 9-36 
Station information 
editing 4-5, 9-36 
Station list 44 
adding or deleting anaddress 2-18 
address not appearing 2-19 
ae a Station for history statistics collection 
displaying 2-16, 2-17 
loading and unloading (figure) 2-19 
Station name 
editing 9-36 
Station names 
inSTARTUP.TRD 84 
lengthof 46 
sorting statistics by 3-10 
Station status 6-8, 6-23, 9-8, 9-15, 9-16 
Station test option 7-5 
Station tests 
protocol-specific 7-5, 9-4 
Station usage alarm 9-29 
Station usage alarm threshold 9-37 


Stations 
active 3-11 
deleting 4-8 
editing information 4-5 
identifying 44 
inserted 3-11 
naming 2-19 
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naming automatically 4-5 
naming manually 4-5 
statuses 9-16 
testing protocols 7-5, 9-4 
unnamed 44 
Statistical view 
after a monitoring session stopped 2-20 
clock in upper-right corner 3-5 
customizing 3-3 
definition 9-7 
displaying previous or next station 3-5 
Single Station 3-7 
Statistical view for all stations 
numeric vs. graphic 3-11 
Statistics 
class 3-4 
display options 3-3 
global 3-5 
global history 3-18 
numeric and graphic displays 3-3 
sort keys 3-10 
Statistics for all stations 
sorted 3-12 
Statistics for transmitted or received frames 
displaying 3-4 
Statistics overflow 9-11, 9-14 
stn option 
Display \Single station menu 3-8, 9-11 
History menu 2-17, 9-5 
Monitor filters menu 2-16, 2-18, 44, 9-5 
Stopping a background monitoring session 2-21 
Stopping a monitoring session 2-20 
before deleting a station from a data file 4-8 
for a station test 9-4 
Stopping monitor's user interface 9-38 
Stopping screen updates 3-5 
Strings in CSV reports 6-16 
Symbolics Private, Ethertype value C-3, C-6 


T 
Talkers report script 6-12, 9-30 
TALKERS.SCR 6-12, 9-30 

Taylor Instrument, Ethertype value C-6 
Terminating automatic report generation 6-18 
Terminating the monitor user interface 9-38 


Test frames 
for station test 9-4 
MAC level 9-4 
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Tests for establishing network's baseline 7-3 
Tigan, Ethertype value C-4 
Time between transmission of two frames 7-6 


Time displayed in graphic Global Statistics view 9-10 


Timestamps 

numeric Global Statistics view 3-6, 9-10 
Title of areport 6-17 
To option 

Station test menu 9-4 
Toggling values fora menu option 2-13 
Token 

circulation 7-6, 9-9 

free 9-10 

lost 9-10 

time needed to acquire 9-3 
Token ring bridges 3-14, 9-20 
Token ring network 

access controlscheme 7-6 

monitor contention 9-9 

remote 9-20 

removing the monitor from 9-9 
Total network capacity 

for measuring network usage 3-4 
Total network traffic 

for measuring network usage 3—4 
Total number of history intervals 9-5 


Total number of stations in a monitoring session 9-8 


Trace Tool Present frame 9-16 


Traffic counts 
numeric Global Statistics view 3-5, 9-8 


TRALARMS directory 5-14, 5-15, 8-3 
Transmit timer 7-6, 9-3 

Transmit timer option 7-6 

Transmit Wait Time view 9-3 

Transmit Wait Time view (figure) 9-3 
TRHIST directory 7-3, 8-3, 9-6 
TRREPORT directory 6-3, 6-19, 8-3, 8-6 
TRSNIFF directory 2-16, 4-3, 8-3 
Tymshare, Ethertype value C-4 

Types of alarm thresholds 54 

Types of frames to monitor 2-15, 2-17 
Types of global alarms 5-5 

Types of stations included in a report script 6-23 
Types of stations to monitor 2-15 


Types of statistics 
class of traffic 3-4 
for displaying numerically or graphically 3-3 


included in All Stations view 3-11 
network usage 3-4 


Types of statistics for display 3-3 
Typical application of the monitor 1-4 
Typical network traffic patterns 7-3 
Typing MENU atDOS prompt 49 


U 


Ungermann-Bass diagnostic/ loopback, Ethertype 
value C-4 


Ungermann-Bass download, Ethertype value C-4 


Ungermann-Bass network debugger, Ethertype value 
C-3 
University of Massachusetts, Amherst 
Ethertype value C-5 


University of Massachusetts, Amherst, Ethertype value 
C-5 


Unknown station alarm threshold 5-5 
Unknown station alarms 4-8, 5-5, 9-27 
Unloading the monitor driver from memory 2-20, 44 
Unnamed addresses 
losing 2-20 
Unnamed stations 44 


Usage alarm 
station 9-29 


Usage alarm threshold 5-5, 5-7, 9-28 
station alarm 9-37 


User interface 
exiting 9-38 
monitor 2-10 

User list report script 6-13 


USERLIST report 44 
contents 4-6 
generating 4-5 
generating before naming stations 4-5 


Userlist report script 9-30 


USERLIST.SCR 6-13, 9-30 
loading 4-5 


Users report script 
CSV format 6-15, 9-30 
normal file format 6-14, 9-30 


USERS.SCR 6-14, 9-30 
USERSCSV.SCR 6-15, 9-30 


V 


VALID system protocol, Ethertype value C-3 
Varian, Ethertype value C-6 
Veeco Integrated Automation, Ethertype value C-5 
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Vendor addresses 8-4 
VG Laboratory Systems, Ethertype value C-6 
View 

definition 9-7 
Viewing ALARM.LOG 5-15 
Viewing previous or next station 3-5 
Viewing station addresses on screen 4-6 


Viewing station history statistics 
for a previous or next interval 3-22 


Vitalink TransLAN III Management, Ethertype value 
C-5 


Vitalink, Ethertype value C-5 


VMTP (Versatile Message Transaction Protocol, RFC- 
1045) (Stanford) 


Ethertype value C-5 


Wait time between transmission of two frames 9-4 
Wait time fora free token 7-6 

Warning messages A-7 to A~9 

Waterloo Microsystems, Ethertype value C-6 
Wellfleet, Ethertype value C-6 


X 
X.25 Level 3, Ethertype value C-3 
X.75 Internet, Ethertype value C-3 


Xerox IEEE 802.3 PUP Address Translation, Ethertype 
value C-3 


Xerox IEEE 802.3 PUP, Ethertype value C-3 
Xerox NS IDP, Ethertype value C-3 


Xerox PUP (conflicts with IEEE 802.3 Length Field, Ether- 
type value range) C-3 


Xerox PUP Address Translation, Ethertype value C-3 
XNS Compatibility, Ethertype value C-3 
Xyplex, Ethertype value C-3 


Index—17 


Sniffer Network Analyzer: Token-Ring Monitor Operations 


Index—18 (Rewor) 


NETWORK GENERAL CORPORATION 


Marketing Publications Comment Form 


At Network General, we are interested in your suggestions to improve this manual. Please 
take a moment to complete the following survey. Your comments are greatly appreciated. 


MANUAL TITLE 


%, oe Me o%, S2 Oe o%e oMe aM 0%, ?, OMe, aMe Me, Me, o%, o%e Me oe ho oe Me oe Mo ce oe Me Me Me oe oe ce Me Me Me, 
~ “~~ “ “ “ “ “~~ “~ “ “~ “ “ “ “~ “ “~~ “ “ “~~ “~~ “~ “~~ “~ tX<2 “ “ “° “° “ “ “ “ “~ “ ~ “ “ee “~ “~ “ “ “~~ “~~ 


How do you use this manual? (check one or more. ) 


|_| To get an overview of the product |] To get out of trouble 
|_| To learn a task | | Other 
[-] To look up a fact 


LESS THAN 
DAILY WEEKLY MONTHLY MONTHLY 


2 How often do you use this ® manual? (check one.) LJ Ud L_| [| 


@ product? (check one.) LJ OC L L 
EF Evaluate the manual? 


Is information... @ accurate? 
@ easy to read? 
@ easy to find? 


~< 
m™m 
” 


COMMENTS 


Are examples... @ helpful? 
@ realistic? 
@ plentiful? 

Are illustrations... @ helpful? 


@ realistic? 
@ plentiful? 


Is the index... @ complete? 
@ accurate? 


4 Did you notice any omissions? 


DIO OO0) OOOO 
DO) O00) UU) UU é 


5 Do you have any general comments or suggestions? 


Network 
General 


T™ 
"We solve network problems.” 


fold here 


NO POSTAGE 
NECESSARY 


IF MAILED 
IN THE 


UNITED STATES 


BUSINESS REPLY MAIL 


FIRST CLASS MAIL PERMIT NO. 9 MENLO PARK, CA 


POSTAGE WILL BE PAID BY ADDRESSEE 


Network General Corporation 

4200 Bohannon Drive 

Menlo Park, CA 94025-9791 

ATTN: Technical Publications Department 


fold here 


The following information will help us better evaluate your needs. 
Position 
Department 


Optional: 
Name 
Company 
Address 
Phone 


Network 
General 


We solve network problems.'™ 


Network General Corporation 
4200 Bohannon Drive 

Menlo Park, California 94025 
(415) 688-2700 


Network General Europe 
Belgicastraat 4 

1930 Zaventem (Brussels), Belgium 
32-2-725-6030 


P/N:20036-002 


